Is Horilla HRMS affected by CVE-2026-40866?

Horilla HRMS 1.5.0 contains an authentication bypass vulnerability that allows authenticated low-privilege employees to modify or corrupt HR documents belonging to any other employee, including executives and administrators.

Horilla HRMS CVE-2026-40866

EUVD-2026-24234 HIGH

Improper Access Control (CWE-284)

2026-04-21 GitHub_M

Authentication Bypass

8.6

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 20:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 19:47 vuln.today

CVSS changed

Apr 21, 2026 - 19:22 NVD

8.6 (HIGH)

DescriptionNVD

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

AnalysisAI

Authenticated users in Horilla HRMS 1.5.0 can overwrite or corrupt any employee's documents via insecure direct object reference (IDOR) in the document upload endpoint. By manipulating the document ID parameter in upload requests, attackers with low-level access can modify HR records belonging to other employees, including executives or administrators. …

RemediationAI

Within 24 hours: Disable or restrict access to the document upload endpoint in Horilla HRMS 1.5.0 until patched; audit all document modifications in the past 30 days for unauthorized changes. Within 7 days: Evaluate upgrade options to a patched version of Horilla HRMS or implement compensating access controls limiting document upload privileges to HR administrators only. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-40866 vulnerability details – vuln.today

Back

Horilla HRMS CVE-2026-40866

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

Horilla HRMS CVE-2026-40866

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code