CVE-2026-40865 is an improper access control vulnerability (CWE-284) in Horilla 1.5.0, an open source HRMS. The issue arises from an insecure direct object reference in the employee document viewer, which allows authenticated users to access documents belonging to other employees by altering the document ID parameter in requests. This flaw exposes sensitive employee records including identity documents, contracts, and certificates. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No patch or official remediation level has been published, and no known exploits have been reported.

Exploitation of this vulnerability allows authenticated users to bypass access controls and view sensitive HR documents of other employees. This can lead to unauthorized disclosure of personally identifiable information and confidential employment records, potentially causing privacy violations and compliance issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the HRMS to trusted users only and monitor for suspicious activity related to document access. Consider implementing additional access control checks or compensating controls at the application or network level to prevent unauthorized document ID manipulation.