Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110099Jorani before 1.0.4 Missing Authorization in HR Export Actions

Medium 4.3

In plain English

A medium-severity missing authorization in Jorani from Jorani. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.

Affected products (as reported)

Vendor	Product	Versions
Jorani	Jorani	0 – before 1.0.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/jorani/jorani/issues/426 issue-tracking, technical-description
https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Hr.php#L459-L500 technical-description
https://github.com/jorani/jorani/commit/dee51fc3c6cb08b45fb2d03f3d44507bc07830e9 patch
Jorani v1.0.4 Release Notes release-notes
VulnCheck Advisory: Jorani before 1.0.4 Missing Authorization in HR Export Actions third-party-advisory