Is there a patch available for CVE-2026-39347?

Yes, a patch is available for CVE-2026-39347. Update the affected software to the latest version immediately.

Orangehrm CVE-2026-39347

Q: What is the CVSS score of CVE-2026-39347?

CVE-2026-39347 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19857 MEDIUM

Improper Authorization (CWE-285)

2026-04-07 GitHub_M

Authentication Bypass Orangehrm

5.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.8.1

EUVD ID Assigned

Apr 07, 2026 - 18:45 euvd

EUVD-2026-19857

Analysis Generated

Apr 07, 2026 - 18:45 vuln.today

CVE Published

Apr 07, 2026 - 18:20 nvd

MEDIUM 5.1

DescriptionGitHub Advisory

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.

AnalysisAI

OrangeHRM Open Source versions 5.0 through 5.8 allow high-privileged administrator users to modify self-appraisal submissions after those submissions have been marked as completed, compromising the integrity of finalized appraisal records. The vulnerability requires administrator authentication and has a CVSS score of 5.1 with low integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

This vulnerability stems from inadequate authorization controls (CWE-285: Improper Authorization) in OrangeHRM's appraisal workflow processing. The system fails to enforce state-based access controls that should prevent modification of appraisal records once they transition to a completed/finalized state. The underlying issue is that the application does not properly verify the lifecycle state of appraisal submissions before accepting modification requests from authenticated administrators, allowing bypass of business logic constraints that protect record integrity. The vulnerability affects the Open Source edition of OrangeHRM, distributed via the CPE identifier cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: OrangeHRM 5.8.1 and later versions contain the fix. Organizations should upgrade from affected versions 5.0 through 5.8 to version 5.8.1 or the latest available release as soon as possible. Administrators should verify the upgrade through the OrangeHRM official releases page and associated GitHub security advisory at https://github.com/orangehrm/orangehrm/security/advisories/GHSA-7j84-w7h5-24pc. Until patching is feasible, implement compensating controls such as restricting administrator account access to only authorized personnel, enabling comprehensive audit logging of appraisal modifications, and conducting regular reviews of completed appraisal records for unauthorized alterations. Testing the patch in a non-production environment is recommended before deployment to production systems.