CVE-2026-110099: Jorani before 1.0.4 Missing Authorization in HR Export Actions
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Jorani user can exploit the affected HR export actions. No elevated HR or administrative role is required.
What access does an attacker need?
The attacker needs valid Jorani credentials and network access to the application. Exploitation does not require user interaction and has low attack complexity.
What data can be exported?
Affected actions can expose employee names, email addresses, contracts, and managers, along with leave and overtime records for any employee.
Which requests are relevant for detection or investigation?
Review authenticated requests to hr/exportEmployees, hr/exportLeaves/{id}, and hr/exportOvertime/{id}. Requests involving unexpected employee IDs or accounts without HR responsibilities may indicate misuse.
Which versions are affected?
Jorani versions before 1.0.4 are affected.