CVE-2026-40867 affects horilla 1.5.0, an open source Human Resource Management System. The vulnerability arises from broken access control in the helpdesk attachment viewer component, where authenticated users can bypass restrictions by altering the attachment ID parameter. This allows unauthorized viewing of attachments belonging to other tickets, potentially exposing sensitive internal documents. The issue is categorized under CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, and high impact on confidentiality.

Exploitation of this vulnerability allows authenticated users to access sensitive attachments from other users' helpdesk tickets without authorization. This can lead to unauthorized disclosure of confidential support files and internal documents, potentially compromising privacy and organizational security. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected horilla 1.5.0 installation to trusted users only. Monitor for updates from the horilla-opensource project regarding patches or mitigations addressing this broken access control vulnerability.