CVE-2025-66291
BaseFortify
Publication date: 2025-11-29
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orangehrm | orangehrm | From 5.0 (inc) to 5.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OrangeHRM versions 5.0 to 5.7 allows an authenticated user with only ESS-level access (which normally does not include recruitment workflows) to retrieve confidential interview attachments. The system's interview attachment retrieval endpoint serves files based solely on an authenticated session and user-supplied identifiers without verifying if the user has permission to access the specific interview record. This means unauthorized users can access sensitive documents like candidate CVs and evaluations because the server does not perform recruitment-level authorization checks.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of confidential interview documents, including candidate CVs, evaluations, and supporting files. An ESS-level user without recruitment access can directly request and obtain sensitive recruitment files, potentially leading to privacy breaches, exposure of personal data, and damage to organizational confidentiality.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OrangeHRM to version 5.8 or later, where the vulnerability has been patched. Until then, restrict ESS-level user access to recruitment modules and monitor access to interview attachment endpoints to prevent unauthorized file retrieval.