Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.0.3 is recommended to address this issue. Patch name: fc5c8e55988e89273012491b5f097b762b474546. It is suggested to upgrade the affected component.
A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component should be upgraded.
CVE-2026-24039 is an improper access control vulnerability in Horilla HRMS version 1.4.0 that allows low-privileged employees to self-approve documents they upload. The approval UI is intended for administrators or high-privilege roles only, but insufficient server-side authorization lets standard employees alter approval status of their own documents. This undermines the integrity of HR processes by enabling unvetted document acceptance. The vulnerability has a CVSS score of 4.3 (medium severity) and does not require user interaction. It affects versions >=1.4.0 and <1.
CVE-2026-24038 is a high-severity improper authentication vulnerability in Horilla HRMS versions 1.4.0 up to but not including 1.5.0. The flaw lies in the OTP verification logic where an expired OTP returns None, and if the attacker omits the OTP field in their request, the comparison incorrectly succeeds, allowing bypass of two-factor authentication. This enables attackers to access accounts without valid OTPs, potentially compromising administrative accounts and sensitive HR data. The vulnerability does not require user interaction but requires some level of privileges (PR:L). No known exploits are currently reported in the wild. The issue has been fixed in version 1.
CVE-2026-24037 is a medium-severity cross-site scripting (XSS) vulnerability in Horilla, an open-source Human Resource Management System (HRMS), affecting versions 1.4.0 up to but not including 1.5.0. The vulnerability arises from an incomplete and context-agnostic input filtering mechanism in the has_xss() function, which fails to properly neutralize malicious input. Exploitation allows attackers to execute arbitrary JavaScript, redirect users to malicious domains, and steal CSRF tokens, enabling further attacks against administrative users. The issue requires high privileges and user interaction but does not impact availability. The vulnerability has been fixed in version 1.5.
CVE-2026-24036 is a medium severity improper access control vulnerability in Horilla, an open-source Human Resource Management System. Versions 1.4.0 through 1.4.x expose unpublished job postings via an unauthenticated endpoint, leaking draft job titles, descriptions, and application links. This unauthorized access can reveal sensitive internal hiring information and disrupt recruitment processes. The vulnerability does not allow modification of data or system compromise but poses confidentiality risks. It has been fixed in version 1.5.
CVE-2026-24035 is an improper access control vulnerability in Horilla HRMS versions 1.4.0 up to but not including 1.5.0. It allows any authenticated employee to upload documents on behalf of other employees due to insufficient server-side validation of the employee_id parameter during file uploads. This flaw does not require user interaction beyond authentication and does not impact confidentiality or availability but can affect data integrity. The vulnerability has a CVSS score of 4.3 (medium severity) and is fixed in version 1.5.
CVE-2026-24034 is a medium severity vulnerability affecting horilla versions prior to 1.5.0, an open-source Human Resource Management System. The flaw arises from unrestricted file upload during profile photo updates, where neither file extension nor content-type is validated. This allows attackers to upload malicious files that can trigger cross-site scripting (XSS) attacks, potentially compromising user confidentiality and integrity. Exploitation requires low privileges but no user interaction, and the vulnerability does not impact availability. The issue is fixed in version 1.5.0. European organizations using horilla versions below 1.
CVE-2026-24010 is a high-severity file upload vulnerability in horilla versions prior to 1.5.0, an open-source Human Resource Management System. Authenticated attackers can upload malicious HTML files disguised as profile pictures, enabling phishing attacks by presenting fake login pages to users. This allows credential theft and potential account takeover without requiring user interaction beyond visiting the malicious URL. The vulnerability stems from improper neutralization of special elements in output used by downstream components (CWE-74). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. The issue is patched in version 1.5.0.
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via uploaded SVG (and via allowed <embed>), which can be chained to execute JavaScript whenever users view impacted content (e.g., announcements). This can result in admin account takeover. This issue has been patched in version 1.4.0.
Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation (for example, with an intercepting proxy or by submitting a crafted request) to store an executable HTML document on the server. When an administrator or other privileged user views the uploaded file, the embedded script runs in their context and sends session cookies (or other credentials) to an attacker-controlled endpoint. The attacker then reuses those credentials to impersonate the admin. This issue has been patched in version 1.4.0.
Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM 1.3.0 allows authenticated admin or privileged users to inject malicious JavaScript payloads into multiple fields in the Project and Task modules. These payloads persist in the database and are executed when viewed by an admin or other privileged users through the web interface. Although the issue is not exploitable by unauthenticated users, it still poses a high risk of session hijacking and unauthorized action within high-privilege accounts. At time of publication there is no known patch.
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.
Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval() function on a user-controlled query parameter in the project_bulk_archive view. This allows privileged users (e.g., administrators) to execute arbitrary system commands on the server. While having Django’s DEBUG=True makes exploitation visibly easier by returning command output in the HTTP response, this is not required. The vulnerability can still be exploited in DEBUG=False mode by using blind payloads such as a reverse shell, leading to full remote code execution. This issue has been patched in version 1.3.1.