Horilla vulnerabilities

Horilla version 1.5.0 has a broken access control vulnerability in the helpdesk attachment viewer that allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents.

Horilla version 1.5.0 has an IDOR vulnerability in the employee document upload endpoint that allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

Horilla version 1.5.0 has an IDOR vulnerability in the employee document viewer that allows any authenticated user to access other employees' uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.

Horilla version 1.4.0 has a vulnerability in OTP handling logic where a flawed equality check can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the comparison user_otp == otp passes, allowing complete bypass of two-factor authentication without providing a valid OTP.

Horilla before version 1.5.0 has a critical file upload vulnerability that, with social engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials.