CVE-2026-40865
HighSummary
Horilla version 1.5.0 has an IDOR vulnerability in the employee document viewer that allows any authenticated user to access other employees' uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
Risk Assessment
The risk includes unauthorized access to sensitive personal data of employees, potentially leading to privacy breaches and identity theft.
Recommendation
Implement object-level access controls for the document viewer and upgrade to a patched version.
Other vulnerabilities in Horilla
See all- CVE-2026-40867High
Horilla version 1.5.0 has a broken access control vulnerability in the helpdesk attachment viewer that allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents.
- CVE-2026-40866High
Horilla version 1.5.0 has an IDOR vulnerability in the employee document upload endpoint that allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the upload request. This enables unauthorized modification of HR records.
- CVE-2026-24038High
Horilla version 1.4.0 has a vulnerability in OTP handling logic where a flawed equality check can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the comparison user_otp == otp passes, allowing complete bypass of two-factor authentication without providing a valid OTP.
- CVE-2026-24010High
Horilla before version 1.5.0 has a critical file upload vulnerability that, with social engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials.
Original NVD description (English source)
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.