Is CVE-2026-39346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39346 being exploited in the wild.

How severe is CVE-2026-39346?

Medium severity, with a CVSS score of 5.4, published 7 April 2026.

Which products and versions are affected?

OrangeHRM OrangeHRM Open Source 5.0 to 5.8.

Is there a fix for CVE-2026-39346?

A patch was published on 2026-04-07: Fix released in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39346 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39346?

Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39346: OrangeHRM Open Source access control bypass in disabled modules

CVE-2026-39346 · Severity: medium · CVSS 5.4 · Published 2026-04-07

OrangeHRM is a human resource management system used by businesses to manage employee data and administrative tasks. A security flaw in the Open Source version allowed logged-in users to access features and modules that administrators had intentionally disabled. This could lead to unauthorized access to sensitive HR functions or data that should be restricted.

Technologies: Orangehrm. Vendors: Orangehrm.

Quick answers

Is CVE-2026-39346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39346 being exploited in the wild.
How severe is CVE-2026-39346?: Medium severity, with a CVSS score of 5.4, published 7 April 2026.
Which products and versions are affected?: OrangeHRM OrangeHRM Open Source 5.0 to 5.8.
Is there a fix for CVE-2026-39346?: A patch was published on 2026-04-07: Fix released in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39346 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39346?: Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability exists in OrangeHRM Open Source (versions 5.0 to 5.8) where the system fails to correctly validate requests for disabled modules when the request path is URL-encoded. An authenticated attacker with low privileges can bypass administrative restrictions by crafting specific URL-encoded requests to access the functionality of modules that have been explicitly disabled by an administrator. This allows for unauthorized interaction with restricted system components, potentially impacting the confidentiality and integrity of HR data. The issue is resolved in version 5.8.1.

Affected products

OrangeHRM OrangeHRM Open Source 5.0 to 5.8

Timeline

2026-04-06: advisory: GitHub advisory published by maintainers
2026-04-07: disclosed: NVD publication date
2026-04-07: patched: Fix released in version 5.8.1

References

https://github.com/orangehrm/orangehrm/security/advisories/GHSA-f254-w9w8-xc8q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.