CVE-2026-110098

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-110098

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110098.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-110098

Published

2026-10-13T16:53:03Z

Modified

2026-10-15T02:47:27Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Details

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110098.json"
}

References

Affected packages

Git / github.com/jorani/jorani

Affected ranges

Type

GIT

Repo

https://github.com/jorani/jorani

Events

Introduced

Fixed

40440bda19a0eb5d4f061eda0a472c1fa7474d8a

Fixed

59c403224401824489ec662934f71c90d27f614c

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.4"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other

Prototype1

v0.*

v0.1

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1_alpha

v0.1_beta

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.5.0

v0.5.1

v0.6.0

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v1.*

v1.0.0

v1.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110098.json"