CVE-2026-110098 Details
Description
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.
A vulnerability allowing insecure direct object reference (IDOR) has been identified in Jorani versions prior to 1.0.4. This vulnerability allows authenticated users to modify, delete, and view other employees' leave and overtime requests. The issue arises because the application only verifies authorization based on operation names, not on ownership of the requests. Users can exploit this by supplying numeric request IDs to certain controller methods, such as 'Leaves::edit()', 'Extra::edit()', 'Leaves::delete()', 'Extra::delete()', and 'Leaves::history()'.
Users can update to Jorani version 1.0.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Extra.php#L151-L168 | [email protected] | Source CodeVendor |
| https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Leaves.php#L276-L298 | [email protected] | Source CodeVendor |
| https://github.com/jorani/jorani/commit/59c403224401824489ec662934f71c90d27f614c | [email protected] | Source CodeVendor |
| https://github.com/jorani/jorani/issues/426 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/jorani/jorani/releases/tag/v1.0.4 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/jorani-before-1.0.4-insecure-direct-object-reference-in-leave-and-overtime-requests | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jorani | >= 0, < 1.0.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |