CVE-2026-86066

Horilla version 1.5.0 has a broken access control vulnerability in the helpdesk attachment viewer that allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents.

Horilla version 1.5.0 has an IDOR vulnerability in the employee document upload endpoint that allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

Horilla version 1.5.0 has an IDOR vulnerability in the employee document viewer that allows any authenticated user to access other employees' uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.

Horilla version 1.4.0 has a vulnerability in OTP handling logic where a flawed equality check can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the comparison user_otp == otp passes, allowing complete bypass of two-factor authentication without providing a valid OTP.

Horilla before version 1.5.0 has a critical file upload vulnerability that, with social engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials.

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.

Horilla from version 1.0.0 to 1.6.0 and 2.0.0 contains a vulnerability in the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py, which render user-controlled content with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata.

Horilla in version 1.5.0-85 and earlier does not consistently authorize access in payroll/views/component_views.py in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions.

Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python's eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. This issue has been patched in version 1.3.1.