Horilla HR CVE-2026-63431

Requires an authenticated Horilla account at any privilege level - the attacker only needs to be a logged-in employee (PR:L); no payroll-view permission and no record ownership are needed, which is precisely the flaw. Exploitation targets the payroll endpoints backing allowances_deductions_tab, view_single_allowance, and view_single_deduction in Horilla 1.5.0-85 and earlier, by substituting the emp_id, allowance_id, or deduction_id identifiers. What LIMITS exploitation: the attacker must possess valid credentials (insider or compromised account), so it is not remote-unauthenticated; impact is confidentiality-only (data disclosure, no modification). Aggravating limitation on defenders: no complete patch exists, and the available fix only covers allowances_deductions_tab, so full remediation is not yet possible.

This is a genuine but moderate-priority authorization flaw, not an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privilege account (any employee), no user interaction, and pure confidentiality impact with no integrity or availability effect. The real risk is bounded by three factors that raw CVSS does not fully convey: (1) it is authorization-only - an authenticated employee reading peers' payroll/loan data, which is an insider-threat and privacy-breach vector rather than a remote-takeover primitive; (2) the affected product is niche open-source HR software with a small footprint; and (3) no EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so there is no signal of active or automated exploitation. However, exploitation is trivial once an attacker has any valid employee login (simple IDOR - increment/substitute emp_id, allowance_id, or deduction_id), and the leaked data (full salary structures, loan disbursements, repayment schedules) is highly sensitive PII/financial data, which justifies the C:H rating. A notable aggravating factor: the vendor advisory (GHSA-c38j-fg3w-7rph) explicitly states no complete fixed version is available, and the patch commit only adds an authorization check to allowances_deductions_tab - leaving view_single_allowance and view_single_deduction potentially still exposed. The one clear data-quality conflict: the source tag labels this 'Authentication Bypass,' but the description and CWE-862 (Missing Authorization) make clear this is an authorization/IDOR issue, not an authentication bypass.

A logged-in employee (or a compromised low-privilege account) browses to the payroll allowance/deduction endpoints and simply substitutes another employee's emp_id, allowance_id, or deduction_id in the request. The application loads and returns the target's salary structure, allowance/deduction amounts, and personal loan disbursement and repayment data without checking record ownership or payroll-view permissions. No public exploit code is identified, but the attack requires only a browser and trivial parameter manipulation.