Is CVE-2026-110099 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110099?

CVE-2026-110099 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-110099

Description

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.