Horilla HRMS CVE-2026-40867

Consult the vendor advisory at https://github.com/horilla/horilla-hr/security/advisories/GHSA-j6qp-j853-qrff for official patch information. No patched version number is confirmed from available data; users should check the Horilla project releases at github.com/horilla/horilla-hr for updates beyond version 1.5.0. If no patch is immediately available, implement these compensating controls with noted trade-offs: (1) Restrict helpdesk module access to only essential staff through role-based access controls - reduces attack surface but limits helpdesk functionality; (2) Deploy web application firewall rules to log and alert on rapid sequential requests to attachment URLs with incrementing IDs - detects enumeration attacks but does not prevent initial unauthorized access; (3) Implement application-layer authentication hooks to validate ticket ownership before serving attachments - requires custom code modification and may introduce performance overhead; (4) Encrypt sensitive attachments at rest with per-ticket keys and enforce decryption authorization server-side - prevents direct file access even if URLs are compromised but adds complexity to attachment handling. Prioritize vendor patch deployment as compensating controls do not fully eliminate the IDOR vulnerability. After patching, audit access logs for suspicious attachment access patterns (e.g., single user accessing attachments across many unrelated tickets) to identify potential prior exploitation.