CVE-2026-40865

Horilla version 1.5.0 has a broken access control vulnerability in the helpdesk attachment viewer that allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents.

Horilla version 1.5.0 has an IDOR vulnerability in the employee document upload endpoint that allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

Horilla version 1.4.0 has a vulnerability in OTP handling logic where a flawed equality check can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the comparison user_otp == otp passes, allowing complete bypass of two-factor authentication without providing a valid OTP.

Horilla before version 1.5.0 has a critical file upload vulnerability that, with social engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials.

Horilla (an HRMS) prior to version 1.4.0 contains a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin's browser, exfiltrate the admin's cookies/CSRF token, and hijack their session. The issue is patched in version 1.4.0.

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

Horilla before version 2.0.0 contains a CSRF vulnerability in the /attendance/approve-validate-attendance-request/ endpoint, where attendance state changes are performed via an HTTP GET before calling save(), so Django does not require CSRF validation. An unauthenticated attacker can cause a logged-in manager to make a top-level request that silently approves attendance with the victim's privileges and attributes the approval to the victim in the audit trail.

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0.

Horilla from version 1.0.0 to 1.6.0 and 2.0.0 contains a vulnerability in the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py, which render user-controlled content with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata.

Horilla in version 1.5.0-85 and earlier does not consistently authorize access in payroll/views/component_views.py in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions.