EUVD-2026-24235Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.
AnalysisAI
Broken access control in Horilla HRMS 1.5.0 helpdesk module allows any authenticated employee to view support ticket attachments belonging to other users by manipulating attachment IDs in URLs. This exposes confidential HR documents, employee grievances, and internal communications across organizational boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must possess valid Horilla HRMS user credentials with access to the helpdesk module. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is MODERATE-HIGH despite the 7.1 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious employee with valid Horilla HRMS credentials logs into the helpdesk system and opens one of their own support tickets to observe the attachment URL structure (e.g., https://hrms.company.com/helpdesk/attachment/1523). They systematically modify the attachment ID parameter in their browser or via automated script, iterating through sequential IDs (1520, 1521, 1522...) to download attachments from other employees' tickets. … |
| Remediation | Consult the vendor advisory at https://github.com/horilla/horilla-hr/security/advisories/GHSA-j6qp-j853-qrff for official patch information. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Horilla HRMS 1.5.0 deployments and document current user access patterns to the helpdesk module. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today