CVE-2026-39346mediumCWE-284

CVE-2026-39346: fallo de gravedad media en orangehrm

OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear orangehrm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. This vulnerability is fixed in 5.8.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
orangehrm · orangehrm
CVEs relacionadas — orangehrm

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-66224CRITICALOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter InjectionEPSS 0.6%CVE-2026-39345MEDIUMOrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template LoaderEPSS 0.3%CVE-2025-66289HIGHOrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password ChangeEPSS 0.3%CVE-2025-66291MEDIUMOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview AttachmentsEPSS 0.2%CVE-2025-66290MEDIUMOrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Candidate AttachmentsEPSS 0.2%CVE-2025-66225HIGHOrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset WorkflowEPSS 0.2%