Is there a patch available for CVE-2026-39346?

Yes, a patch is available for CVE-2026-39346. Update the affected software to the latest version immediately.

Orangehrm CVE-2026-39346

Q: What is the CVSS score of CVE-2026-39346?

CVE-2026-39346 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19856 MEDIUM

Improper Access Control (CWE-284)

2026-04-07 GitHub_M

Authentication Bypass Orangehrm

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.8.1

EUVD ID Assigned

Apr 07, 2026 - 18:45 euvd

EUVD-2026-19856

Analysis Generated

Apr 07, 2026 - 18:45 vuln.today

CVE Published

Apr 07, 2026 - 18:19 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.

AnalysisAI

OrangeHRM Open Source versions 5.0 through 5.8 allow authenticated users to bypass module access controls by submitting URL-encoded request paths, enabling unauthorized access to administrator-disabled functionality. The vulnerability requires valid user credentials but presents a moderate confidentiality and integrity risk. A vendor-released patch is available in version 5.8.1.

Technical ContextAI

OrangeHRM implements module-level access controls to restrict which features administrators enable for different user roles. The vulnerability exists in the access control enforcement mechanism (CWE-284: Improper Access Control), where the application fails to properly canonicalize or decode URL-encoded path parameters before checking module authorization policies. By submitting requests with URL-encoded path segments (e.g., using %2F for forward slashes or other encoded characters), authenticated attackers can bypass the module disable checks and invoke functionality that administrators have explicitly disabled. This is a classic access control bypass pattern where insufficient input normalization allows attackers to circumvent security boundaries. The affected product is OrangeHRM (CPE: cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*) in versions 5.0 through 5.8.

RemediationAI

Upgrade OrangeHRM to version 5.8.1 or later; this is the vendor-released patch that resolves the access control bypass. Organizations unable to immediately upgrade should implement compensating controls such as restricting direct URL access to sensitive modules, implementing Web Application Firewall (WAF) rules to block URL-encoded path sequences targeting disabled modules, and auditing user activity logs for unusual access patterns to disabled functionality. Administrators should also audit module access controls to ensure appropriate restrictions are in place for sensitive features. Details are provided in the GitHub security advisory at https://github.com/orangehrm/orangehrm/security/advisories/GHSA-f254-w9w8-xc8q.