CVE-2026-39347

LOW

OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

Title source: cna
STIX 2.1

Description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.

References (1)

Scores

CVSS v3 2.7
EPSS 0.0003
EPSS Percentile 9.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-285
Status published
Products (2)
orangehrm/orangehrm 5.0 - 5.8.1
orangehrm/orangehrm >= 5.0, < 5.8.1
Published Apr 07, 2026
Tracked Since Apr 08, 2026