Which versions of Horilla HRMS are affected by CVE-2026-40866?

Horilla HRMS 1.5.0 contains an authentication bypass vulnerability that allows authenticated low-privilege employees to modify or corrupt HR documents belonging to any other employee, including…

How to fix or mitigate CVE-2026-40866?

Within 24 hours: Disable or restrict access to the document upload endpoint in Horilla HRMS 1.5.0 until patched; audit all document modifications in the past 30 days for unauthorized changes. Within 7 days: Evaluate upgrade options to a patched version of Horilla HRMS or implement compensating access controls limiting document upload privileges to HR administrators only. Within 30 days: Complete migration to a patched Horilla HRMS version or deploy a reverse-proxy rule enforcing document ownership validation on all upload requests.

Horilla HRMS CVE-2026-40866

Q: What is the CVSS score of CVE-2026-40866?

CVE-2026-40866 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24234 HIGH

Improper Access Control (CWE-284)

2026-04-21 GitHub_M

Authentication Bypass Horilla Horilla Opensource

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 20:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 19:47 vuln.today

CVSS changed

Apr 21, 2026 - 19:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 19:00 euvd

EUVD-2026-24234

Analysis Generated

Apr 21, 2026 - 19:00 vuln.today

CVE Published

Apr 21, 2026 - 18:15 nvd

HIGH 8.6

DescriptionGitHub Advisory

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

AnalysisAI

Authenticated users in Horilla HRMS 1.5.0 can overwrite or corrupt any employee's documents via insecure direct object reference (IDOR) in the document upload endpoint. By manipulating the document ID parameter in upload requests, attackers with low-level access can modify HR records belonging to other employees, including executives or administrators. This enables unauthorized tampering with sensitive personnel files such as contracts, certifications, or compliance documents. EPSS data not available; no confirmed active exploitation (not in CISA KEV), though exploitation requires only basic authentication and no technical complexity (CVSS AV:N/AC:L/PR:L).

Technical ContextAI

This is a classic insecure direct object reference (IDOR) vulnerability, classified as CWE-284 (Improper Access Control). The affected product is Horilla HRMS, an open-source human resource management system written in Python/Django. The document upload API endpoint fails to validate whether the authenticated user has authorization to modify the target document before processing the upload. By changing the document ID in the HTTP request (likely a POST parameter or path variable), an attacker can reference documents owned by other employees. The CVSS vector indicates network-accessible (AV:N), low attack complexity (AC:L), requiring only low-privilege authentication (PR:L), with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N). The vulnerability exists specifically in version 1.5.0 per the GitHub Security Advisory.

RemediationAI

Upgrade Horilla HRMS from version 1.5.0 to the patched release version identified in the GitHub Security Advisory at https://github.com/horilla/horilla-hr/security/advisories/GHSA-q2qh-v828-r4p7 (specific patched version number not provided in available data - consult advisory directly). If immediate patching is not feasible, implement compensating controls: disable the document upload feature entirely via application configuration until patching is complete (prevents all document modifications but maintains read access), or implement reverse proxy/WAF rules to validate document ID ownership against authenticated session user before forwarding upload requests to the application (requires custom logic mapping users to authorized document IDs, adds latency and maintenance overhead). Audit existing document records for unexpected modifications by reviewing upload timestamps and user attribution logs to identify potential historical exploitation.