Administrator users can alter self‑appraisal submissions after they have been marked completed, overturning the integrity of finalized appraisal records. This flaw allows a privileged attacker to change performance data that may shape HR decisions, promotions, or disciplinary actions. The weakness is an improper access control violation (CWE‑285).

OrangeHRM Open Source releases from 5.0 through 5.8 are vulnerable. The issue is present in all 5.x versions up to and including 5.8 and was resolved in 5.8.1. Users of any impacted version should verify their current build against the fixed release.

The CVSS score of 5.1 indicates moderate risk, while an EPSS score below 1 percent suggests low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known active exploits exist. The likely attack vector requires authenticated administrator access; an attacker who can log on as an admin can edit appraisal records after completion.