The vulnerability in present Jorani versions before 1.0.4 is a missing authorization flaw in the Hr controller’s exportLeaves, exportOvertime and exportEmployees actions. Because no role checks are performed before these endpoints, any authenticated user can request hr/exportEmployees or hr/exportLeaves/{id} or hr/exportOvertime/{id}. The exported data contains sensitive employee names, emails, contracts, managers and any employee’s leave and overtime records, compromising confidentiality and potentially enabling insider misuse. This flaw is classified under CWE‑862, representing a missing or incorrect authorization check.

The affected product is Jorani, a web‑based HR management application. Versions prior to 1.0.4, including 1.0.2, are vulnerable. The issue was fixed in the 1.0.4 release and later versions of Jorani.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already be an authenticated user of the Jorani application, which can be achieved by compromising credentials or by acting as an insider. Once authenticated, the attacker can issue simple HTTP requests to the export endpoints to download the protected data. No additional network or system prerequisites are specified, therefore the attack vector is likely a standard web request from an authenticated session.