CVE-2026-110098

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated users can view, modify, or delete other employees' leave and overtime requests by swapping request IDs. An attacker only needs a standard user account on the Jorani instance.

Root cause

The application authorizes actions based solely on the operation name instead of verifying whether the requesting user owns the targeted record ID.

Affected systems

Jorani versions prior to 1.0.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade Jorani to version 1.0.4 or later. If updating immediately is not possible, restrict access to the application or apply commit 59c403224401824489ec662934f71c90d27f614c directly.

shell

$ git fetch --tags && git checkout v1.0.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110098