Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39347OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion

Medium 5.1

In plain English

A medium-severity security flaw in orangehrm from orangehrm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source accepts changes to self-appraisal submissions for administrator users after those submissions have been marked completed, breaking integrity of finalized appraisal records. This vulnerability is fixed in 5.8.1.

Affected products (as reported)

Vendor	Product	Versions
orangehrm	orangehrm	>= 5.0, < 5.8.1

Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/orangehrm/orangehrm/security/advisories/GHSA-7j84-w7h5-24pc x_refsource_CONFIRM