A vulnerable version of Jorani before 1.0.4 permits an authenticated user to act on any leave or overtime request by supplying a numeric request identifier. The flaw allows the attacker to edit, delete, and view the details of other employees’ requests, as well as read leave history. The result is a breach of confidentiality and integrity of personnel data but does not grant code execution or system compromise.

Jorani versions older than 1.0.4 are affected. Specific version numbers are not listed in the data, but the fix is present from version 1.0.4 onward.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the expected exploitation likelihood is unknown but is likely limited to authenticated users with internal access. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit has been reported. Attackers need only supply valid numeric request IDs to controller routes such as Leaves::edit, Extra::edit, Leaves::delete, Extra::delete, and Leaves::history, within an authenticated session. If internal credentials are compromised, an attacker can tamper with or read colleagues’ leave and overtime data, potentially enabling covert data manipulation or privacy violations.