CVE-2026-110099 — Jorani before 1.0.4 Missing Authorization in HR Export Actions
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated us…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7