CVE-2026-40866 affects Horilla 1.5.0, an open source HRMS, where an insecure direct object reference vulnerability in the employee document upload endpoint permits any authenticated user to alter the document ID parameter to overwrite or corrupt documents of other employees. This represents improper access control (CWE-284) and potentially unsafe handling of object references (CWE-639). The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality and integrity of HR data. No patch or official remediation level has been published, and the product is not a cloud service.

Exploitation of this vulnerability allows an authenticated user to modify or corrupt HR documents of other employees without authorization. This can lead to unauthorized data tampering, loss of data integrity, and potential disruption of HR operations. Confidentiality impact is high as sensitive employee documents can be altered. There is no indication of availability impact or privilege escalation beyond the authenticated user level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the document upload functionality to trusted users only and monitor for suspicious activity related to document modifications. Avoid granting unnecessary authenticated access to users who do not require document upload capabilities.