CVE-2026-110099 json
Jorani before 1.0.4 Missing Authorization in HR Export Actions
published 2026-10-13 27 d ago modified 2026-10-16 23 d ago also EUVD-2026-98932
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
Patch / fix
- Jorani Jorani 1.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 27 d ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Jorani Jorani
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/jorani/jorani/commit/dee51fc3c6cb08b45fb2d03f3d44507bc07830e9
patch
-
github.com
/jorani/jorani/issues/426
issue-tracking, technical-description
-
github.com
/jorani/jorani/blob/v1.0.2/application/controllers/Hr.php#L459-L500
technical-description
-
github.com
/jorani/jorani/releases/tag/v1.0.4
release-notes
-
vulncheck.com
/advisories/jorani-before-1.0.4-missing-authorization-in-hr-export-actions
third-party-advisory
Sources
- CVE List CVE-2026-110099
- NVD CVE-2026-110099
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.