High · published November 29, 2025
🚨 A disabled user can still waltz right into the system! OrangeHRM versions 5.0 to 5.7 don’t invalidate active sessions when a user is disabled or when a password is changed! ⚡ Think of it like a nightclub that doesn’t check if someone’s on the guest list anymore; even if they’ve been kicked out, they can still get in as long as they hold onto that original wristband. This oversight means that an attacker, or even a former employee with a disabled account, can continue to access sensitive information and perform actions as if they were still fully authorized. This is absolutely devastating for security, as it allows unauthorized access to persist even after critical security actions are taken, leaving your data in jeopardy.
Think of it like a nightclub that doesn’t check if someone’s on the guest list anymore; even if they’ve been kicked out, they can still get in as long as they hold onto that original wristband. The flaw arises because the system fails to revoke session cookies when a user's status changes—either by being disabled or changing their password—allowing ongoing access via stale sessions.
This oversight means that an attacker, or even a former employee with a disabled account, can continue to access sensitive information and perform actions as if they were still fully authorized. This is absolutely devastating for security, as it allows unauthorized access to persist even after critical security actions are taken, leaving your data in jeopardy. Upgrade to OrangeHRM version 5.8 immediately to patch this vulnerability. Additionally, ensure that session management practices are in place to invalidate sessions on significant changes like account status or password updates. Regular audits of active sessions can also help identify unauthorized access. You've got this! Follow these steps to protect your HRM system and secure your sensitive data! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| orangehrm/orangehrm | ≥ 5.0, < 5.8 | 5.8 |