Horilla-hr, an HR and CRM software, has a CSRF vulnerability (CWE-352) in the approve_validate_attendance_request endpoint (/attendance/approve-validate-attendance-request/) prior to version 2.0.0. The endpoint changes attendance validation state via an HTTP GET request without CSRF protection, allowing an unauthenticated attacker to induce a logged-in manager with the appropriate permission (attendance.change_attendance) to perform unauthorized attendance approvals. The attack leverages the victim's SameSite=Lax session cookie, causing the approval to be recorded under the victim's identity in the audit trail. This vulnerability is resolved in version 2.0.0.

An attacker can cause a logged-in manager to unknowingly approve attendance requests, potentially leading to unauthorized modifications in attendance records. The approvals are attributed to the victim in audit logs, which could affect accountability and trust in the system. The vulnerability requires the victim to be logged in and have the attendance.change_attendance permission. There are no known exploits in the wild as of the publication date.

Upgrade horilla-hr to version 2.0.0 or later, where this CSRF vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 2.0.0, applying this official fix is the recommended remediation. No other mitigation steps are indicated.