OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has permission to access the associated interview record. Because the server does not perform any recruitment-level authorization checks, an ESS-level user with no access to recruitment workflows can directly request interview attachment URLs and receive the corresponding files. This exposes confidential interview documents—including candidate CVs, evaluations, and supporting files—to unauthorized users. The issue arises from relying on predictable object identifiers and session presence rather than validating the user’s association with the relevant recruitment process. This issue has been patched in version 5.8.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Orangehrm
  • Orangehrm

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Orangehrm
  • Orangehrm
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/orangehrm/orangehrm/commit/647133d0fdda989a4836845a6531277078a84607 cve-icon cve-icon
https://github.com/orangehrm/orangehrm/security/advisories/GHSA-v32g-r8xx-4g6g cve-icon cve-icon
History

Mon, 01 Dec 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Orangehrm
Orangehrm orangehrm
Vendors & Products Orangehrm
Orangehrm orangehrm

Sat, 29 Nov 2025 03:30:00 +0000

Type Values Removed Values Added
Description OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has permission to access the associated interview record. Because the server does not perform any recruitment-level authorization checks, an ESS-level user with no access to recruitment workflows can directly request interview attachment URLs and receive the corresponding files. This exposes confidential interview documents—including candidate CVs, evaluations, and supporting files—to unauthorized users. The issue arises from relying on predictable object identifiers and session presence rather than validating the user’s association with the relevant recruitment process. This issue has been patched in version 5.8.
Title OrangeHRM is Vulnerable to Improper Authorization Allowing Unauthorized Access to Interview Attachments
Weaknesses CWE-200
CWE-285
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-11-29T03:08:00.546Z

Reserved: 2025-11-26T23:11:46.392Z

Link: CVE-2025-66291

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2025-11-29T04:15:58.200

Modified: 2025-12-01T15:39:33.110

Link: CVE-2025-66291

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-01T15:18:21Z