OrangeHRM up to 5.7 Recruitment improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in OrangeHRM up to 5.7. The impacted element is an unknown function of the component Recruitment Module. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2025-66291. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in OrangeHRM up to 5.7 and classified as critical. Affected by this vulnerability is some unknown functionality of the component Recruitment Module. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. The summary by CVE is:

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment module serves files based solely on an authenticated session and user-supplied identifiers, without verifying whether the requester has permission to access the associated interview record. Because the server does not perform any recruitment-level authorization checks, an ESS-level user with no access to recruitment workflows can directly request interview attachment URLs and receive the corresponding files. This exposes confidential interview documents—including candidate CVs, evaluations, and supporting files—to unauthorized users. The issue arises from relying on predictable object identifiers and session presence rather than validating the user’s association with the relevant recruitment process. This issue has been patched in version 5.8.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-66291 since 11/27/2025. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 5.8 eliminates this vulnerability. Applying the patch 647133d0fdda989a4836845a6531277078a84607 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199903). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• OrangeHRM

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7

License

• open-source

Website

• Product: https://github.com/orangehrm/orangehrm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion