Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other… (CVE-2026-110098)

The vulnerability in Jorani prior to version 1.0.4 is an insecure direct object reference (CWE-639) that permits authenticated users to bypass proper authorization controls. By supplying numeric request IDs to functions such as Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history(), an attacker can tamper with or view other employees' leave and overtime requests. Authorization is improperly enforced by operation name only, allowing unauthorized access to sensitive employee data.

An attacker with valid authentication can view, modify, or delete other employees' leave and overtime requests and access leave history. This compromises confidentiality and integrity of employee data but does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited impact on confidentiality and integrity.

A fix is available in Jorani version 1.0.4. Users should upgrade to version 1.0.4 or later to remediate this vulnerability. No vendor advisory or patch link was provided, so verify the patch status with the official Jorani project resources before applying.