The vulnerability arises from missing authorization checks in the file download handlers of OrangeHRM Open Source versions 5.0 through 5.8. This allows any authenticated user with low privileges to download attachments by directly referencing attachment identifiers, resulting in the unintended disclosure of potentially sensitive HR data such as job specifications and vacancy attachments.

OrangeHRM Open Source, versions 5.0 to 5.8 inclusive.

The CVSS score of 5.3 indicates moderate severity, and an EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The exploitation requires a legitimate authenticated session and knowledge of attachment identifiers, exposing the system to confidentiality risks. The vulnerability is not listed in CISA's KEV catalog.