Is CVE-2026-39347 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39347 being exploited in the wild.

How severe is CVE-2026-39347?

Low severity, with a CVSS score of 2.7, published 7 April 2026.

Which products and versions are affected?

OrangeHRM OrangeHRM Open Source 5.0 to 5.8.

Is there a fix for CVE-2026-39347?

A patch was published on 2026-04-07: Fixed in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39347 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39347?

Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39347: OrangeHRM improper authorization in self-appraisal submissions

CVE-2026-39347 · Severity: low · CVSS 2.7 · Published 2026-04-07

OrangeHRM, a human resource management system, contains a flaw that allows administrator users to modify their own performance self-appraisals even after they have been officially completed and finalized. This undermines the integrity of the company's performance review records, as finalized documents should be immutable. While this does not lead to a data breach or system outage, it allows for the unauthorized alteration of official HR records.

Technologies: Orangehrm. Vendors: Orangehrm.

Quick answers

Is CVE-2026-39347 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39347 being exploited in the wild.
How severe is CVE-2026-39347?: Low severity, with a CVSS score of 2.7, published 7 April 2026.
Which products and versions are affected?: OrangeHRM OrangeHRM Open Source 5.0 to 5.8.
Is there a fix for CVE-2026-39347?: A patch was published on 2026-04-07: Fixed in version 5.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39347 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39347?: Check whether you run Orangehrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285) in OrangeHRM Open Source versions 5.0 through 5.8 allows users with administrative privileges to bypass state-change restrictions on performance reviews. Specifically, the application fails to properly enforce read-only status on self-appraisal submissions once they have reached a 'completed' state. An attacker with high privileges can exploit this over the network to alter finalized appraisal data, leading to a loss of data integrity. The issue is resolved in version 5.8.1 by implementing stricter server-side validation on the status of appraisal records during update requests.

Affected products

OrangeHRM OrangeHRM Open Source 5.0 to 5.8

Timeline

2026-04-06: advisory: GitHub advisory published by vendor
2026-04-07: disclosed: CVE published to NVD
2026-04-07: patched: Fixed in version 5.8.1

References

https://github.com/orangehrm/orangehrm/security/advisories/GHSA-7j84-w7h5-24pc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.