Is there a patch available for CVE-2026-39348?

Yes, a patch is available for CVE-2026-39348. Update the affected software to the latest version immediately.

Orangehrm CVE-2026-39348

Q: What is the CVSS score of CVE-2026-39348?

CVE-2026-39348 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19858 MEDIUM

Missing Authorization (CWE-862)

2026-04-07 GitHub_M

Authentication Bypass Orangehrm

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

5.8.1

EUVD ID Assigned

Apr 07, 2026 - 18:45 euvd

EUVD-2026-19858

Analysis Generated

Apr 07, 2026 - 18:45 vuln.today

CVE Published

Apr 07, 2026 - 18:21 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source omits authorization on job specification and vacancy attachment download handlers, allowing authenticated low-privilege users to read attachments via direct reference to attachment identifiers. This vulnerability is fixed in 5.8.1.

AnalysisAI

OrangeHRM 5.0 through 5.8 allows authenticated low-privilege users to bypass authorization controls and directly access job specification and vacancy attachment files by manipulating attachment identifiers, exposing sensitive HR documents. The vulnerability affects the attachment download handlers which fail to validate user permissions before serving files. This issue is fixed in version 5.8.1.

Technical ContextAI

OrangeHRM's job specification and vacancy attachment download handlers implement insufficient authorization checks (CWE-862: Missing Authorization). The vulnerability allows authenticated users with low privileges to enumerate and access attachment identifiers without proper role-based or resource-level access control. The attachment download functionality accepts direct references to attachment identifiers in requests but does not verify whether the requesting user has legitimate access to that specific resource or document. This is a classic authorization bypass where the system authenticates the user but fails to enforce authorization policies on sensitive document retrieval endpoints.

RemediationAI

Upgrade OrangeHRM to version 5.8.1 or later, which implements proper authorization controls on attachment download handlers. Users unable to immediately upgrade should restrict access to the application to trusted staff only and monitor access logs for unusual patterns of attachment file requests. See the vendor security advisory at https://github.com/orangehrm/orangehrm/security/advisories/GHSA-mm39-mv56-754r for detailed patch information and confirmation of the fix.