Insufficient Authorization in OrangeHRM's Recruitment Attachment Retrieval Process

CVE-2025-66290

What is CVE-2025-66290?

In OrangeHRM versions 5.0 to 5.7, the application fails to properly enforce authorization checks for its recruitment attachment retrieval endpoint. This oversight allows authenticated users, even those with limited access rights, to gain unauthorized access to sensitive candidate information, such as CVs and other documents. Specifically, any user can exploit the attachment endpoint to download files for candidates without having the necessary permissions, exposing potentially confidential applicant data. This vulnerability has been addressed in version 5.8 of OrangeHRM.

References