CVEvulnerability

CVE-2026-24035

4.3 MEDIUM Published 2026-01-22 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-01-22
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-284

Description

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.

Affected configurations

• horilla horilla 1.4.0

Weakness · CWE (1)

CWE-284 Improper Access Control weakness

References

https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing Exploit
https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 Release Notes
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3 Exploit, Vendor Advisory

CVE-2026-24035

Description

Affected configurations

Related

Weakness · CWE (1)

References