CVE-2026-110098: Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Any authenticated Jorani user who can reach the affected leave or overtime request operations may be able to access requests belonging to other employees. The issue affects authorization checks that rely on the operation name rather than ownership of the specific request.
What does an attacker need to exploit it?
The attacker needs valid authentication and a numeric identifier for a target leave or overtime request. No user interaction is required, and the attacker can submit that identifier to the affected edit, delete, or history functions.
What actions can an attacker perform against another employee's requests?
An attacker can view other employees' leave history and modify or delete their leave and overtime requests. This can affect the confidentiality and integrity of request data, but the provided information does not indicate an availability impact.
Are default deployments affected?
The provided information identifies Jorani versions before 1.0.4 as affected, but it does not state whether any particular default configuration enables or prevents exploitation. Exposure depends on authenticated users being able to access the affected request operations.