CVE-2026-110099 in Jorani
Summary
by MITRE • 10/13/2026
Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Jorani versions prior to 1.0.4 represents a critical failure in access control mechanisms within the Human Resources module of the application. Specifically, the flaw resides in three distinct controller actions: exportLeaves, exportOvertime, and exportEmployees. These endpoints are designed to generate downloadable reports containing sensitive personnel data, yet they lack proper authorization checks that verify whether the requesting user has the requisite administrative privileges or specific role-based permissions to access such information. Consequently, any authenticated user, regardless of their assigned role within the organization, can invoke these functions to retrieve confidential HR records. This type of flaw is a classic example of insecure direct object references combined with broken access control, where the system trusts the identity of the user but fails to validate whether that user is authorized to perform the specific action requested.
From a technical perspective, the exploitation vector involves sending HTTP requests directly to the endpoints hr/exportEmployees, hr/exportLeaves/{id}, and hr/exportOvertime/{id}. Because the server does not enforce role-based access control on these routes, an attacker who has valid credentials for any standard employee account can initiate these exports. The resulting data dumps include highly sensitive personally identifiable information such as full names, email addresses, employment contracts, reporting managers, and detailed records of leave requests and overtime hours worked by employees. This exposure is particularly severe because it allows low-privilege users to escalate their effective access level without needing any additional exploits or privilege escalation techniques beyond simple authentication. The vulnerability aligns with CWE-269, which covers Improper Privilege Management, as well as CWE-862, Missing Authorization, highlighting the fundamental gap in verifying user permissions before processing sensitive data requests.
The operational impact of this vulnerability is significant for organizations relying on Jorani for workforce management and HR administration. The unauthorized disclosure of employee contracts and personal contact information can lead to severe privacy violations under regulations such as GDPR or other local data protection laws. Furthermore, the exposure of leave balances and overtime records provides adversaries with valuable intelligence that could facilitate social engineering attacks, identity theft, or targeted phishing campaigns against specific individuals within the organization. Attackers may also use this aggregated HR data to map out organizational hierarchies and identify high-value targets for further compromise. The ease of exploitation means that even non-technical users with basic knowledge of web application interactions can exploit this flaw, increasing the likelihood of successful attacks in real-world scenarios where credential theft or account sharing is common.
To mitigate this vulnerability, organizations running Jorani versions earlier than 1.0.4 must upgrade to version 1.0.4 or later immediately, as these updates include patches that enforce proper authorization checks on the affected endpoints. Until an upgrade can be performed, administrators should implement compensating controls such as web application firewall rules that restrict access to HR export functions based on IP addresses or user roles if possible. Additionally, it is advisable to audit existing logs for any suspicious requests to these specific URLs and rotate credentials for all accounts that may have been compromised during the window of exposure. Long-term remediation strategies should include integrating automated security testing into the development lifecycle to detect missing authorization checks early in the software development process, ensuring that sensitive endpoints are consistently protected by robust access control policies aligned with industry standards like OWASP Top 10 and MITRE ATT&CK techniques related to Collection via File Directory Discovery or Data from Information Repositories.