CVE-2025-66290
BaseFortify
Publication date: 2025-11-29
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orangehrm | orangehrm | From 5.0 (inc) to 5.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OrangeHRM versions 5.0 to 5.7 where the recruitment attachment retrieval endpoint does not enforce authorization checks. This means that even users with limited ESS-level access, who normally cannot view the Recruitment module, can directly access candidate attachment URLs. The system validates the user's session but fails to verify if the user has permission to access recruitment data, allowing any authenticated user to download sensitive candidate files such as CVs and other uploaded documents without proper authorization.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized exposure of sensitive applicant data. Any authenticated user, regardless of their permission level, can access and download confidential candidate attachments. This could result in privacy breaches, data leaks, and potential misuse of personal information contained in the recruitment documents.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OrangeHRM to version 5.8 or later, where the issue has been patched. Until the upgrade can be applied, restrict access to the recruitment attachment retrieval endpoint to authorized users only, and monitor authenticated requests to this endpoint for unusual access patterns.