CVE-2026-39345

OrangeHRM Open Source from version 5.0 to 5.8 encrypts sensitive fields with AES in ECB mode, preserving plaintext patterns in ciphertext and enabling pattern disclosure against stored data. Fixed in version 5.8.1.

OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records.

OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.

OrangeHRM versions 5.0 to 5.7 have an interview attachment retrieval endpoint in the Recruitment module that serves files based solely on an authenticated session and user-supplied identifiers, without verifying permission to access the associated interview record. An ESS-level user with no recruitment access can retrieve confidential documents such as candidate CVs and evaluations.

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application's recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.

OrangeHRM versions 5.0 to 5.7 do not invalidate existing sessions when a user is disabled or a password is changed, so active session cookies remain valid indefinitely. A disabled or compromised account can continue accessing protected pages. Fixed in version 5.8.

In OrangeHRM 5.0 through 5.7, the password reset workflow does not enforce that the username in the final reset request matches the account for which the reset was initiated. An attacker can alter the username parameter to set a new password for any chosen account, including privileged ones.

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system's sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.