CVE-2026-39347CWE-285

OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

Medium · published April 7, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-04-07T18:20Z
EPSS history
Timeline
  • 07 APR 18:20Z
    OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion
    cvelistv5