CVE-2026-110099

4.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated users can download sensitive employee details, contract info, leave records, and overtime data across the organization. Attackers only need basic login access to the Jorani web interface.

Root cause

The Hr controller endpoints for exportLeaves, exportOvertime, and exportEmployees fail to enforce authorization checks on incoming requests.

Affected systems

Jorani versions prior to 1.0.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Jorani to version 1.0.4 or later. If updating immediately is not possible, block or restrict web access to the endpoints /hr/exportEmployees, /hr/exportLeaves, and /hr/exportOvertime via your reverse proxy or web server configuration.

shell

$ git fetch --tags && git checkout v1.0.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110099