CVE-2026-110098

Description

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

References

https://www.vulncheck.com/advisories/jorani-before-1.0.4-insecure-direct-object-reference-in-leave-and-overtime-requests

https://github.com/jorani/jorani/releases/tag/v1.0.4

https://github.com/jorani/jorani/issues/426

https://github.com/jorani/jorani/commit/59c403224401824489ec662934f71c90d27f614c

https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Leaves.php#L276-L298

https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Extra.php#L151-L168

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98931

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4