Missing Authorization Vulnerability in Jorani HR Software
CVE-2026-110099

5.3MEDIUM

Key Information:

Vendor

Jorani

Status
Jorani
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110099?

The Jorani HR software versions prior to 1.0.4 are susceptible to a missing authorization vulnerability. This flaw in the HR controller allows authenticated users to bypass security controls and access sensitive HR data. Specifically, attackers can exploit endpoints such as hr/exportEmployees, hr/exportLeaves/{id}, and hr/exportOvertime/{id} to download critical information, including employee names, emails, contracts, and detailed leave and overtime records without proper authorization.

Affected Version(s)

Jorani 0 < 1.0.4

References

https://github.com/jorani/jorani/issues/426
issue-trackingtechnical-description
https://github.com/jorani/jorani/blob/v1.0.2/application/...
technical-description
https://github.com/jorani/jorani/commit/dee51fc3c6cb08b45...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.