Auth bypass in Orangehrm
CVE-2025-66290
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no permission to view the Recruitment module, can directly access candidate attachment URLs. When an authenticated request is made to the attachment endpoint, the system validates the session but does not confirm that the requesting user has the necessary recruitment permissions. As a result, any authenticated user can download CVs and other uploaded documents for arbitrary candidates by issuing direct requests to the attachment endpoint, leading to unauthorized exposure of sensitive applicant data. This issue has been patched in version 5.8.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (8.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Orangehrm — versions >= 5.0, < 5.8
Weakness classification (CWE)
References
- github.com/orangehrm/orangehrm/security/advisories/GHSA-qf8r-c54j-jw88 (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-66290?
- CVE-2025-66290 is a medium-severity vulnerability in Orangehrm, classified under Information Disclosure. CVSS score: 4.3/10. Published 2025-11-29.
- How severe is CVE-2025-66290?
- Medium severity. CVSS v3 base score is 4.3 out of 10.