Executive Summary

This vulnerability in OrangeHRM versions 5.0 to 5.7 allows an authenticated user with only ESS-level access (which normally does not include recruitment workflows) to retrieve confidential interview attachments. The system's interview attachment retrieval endpoint serves files based solely on an authenticated session and user-supplied identifiers without verifying if the user has permission to access the specific interview record. This means unauthorized users can access sensitive documents like candidate CVs and evaluations because the server does not perform recruitment-level authorization checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of confidential interview documents, including candidate CVs, evaluations, and supporting files. An ESS-level user without recruitment access can directly request and obtain sensitive recruitment files, potentially leading to privacy breaches, exposure of personal data, and damage to organizational confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OrangeHRM to version 5.8 or later, where the vulnerability has been patched. Until then, restrict ESS-level user access to recruitment modules and monitor access to interview attachment endpoints to prevent unauthorized file retrieval.

Useful 0 Not Useful 0