EUVD-2026-29692Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because authentication is required; UI:R because victim must click; S:C and C:L/I:L because the redirect affects the victim's browser session outside the application boundary.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.
AnalysisAI
Open redirect in Horilla HR and CRM version 1.5.0 enables authenticated attackers to weaponize trusted application notification links into phishing redirects targeting other users. Four notification endpoint handlers (mark_all_as_read, mark_as_read, mark_as_unread, delete) in notifications/views.py pass the unvalidated next GET parameter directly to Django's redirect() without checking the destination host, allowing external URL injection. SSVC confirms a proof-of-concept exists; exploitation is not automatable and the vulnerability is not listed in CISA KEV, placing real-world risk firmly in the social-engineering category rather than direct system compromise.
Technical ContextAI
Horilla HR is a Django-based open-source human resources and CRM platform (CPE: cpe:2.3:a:horilla:horilla-hr). The vulnerability is CWE-601 (URL Redirection to Untrusted Site / Open Redirect), a classic Django anti-pattern where user-supplied input to the next parameter is forwarded to redirect() without host validation. The commit diff at 734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6 shows the root cause precisely: all four notification view functions previously executed redirect(_next) unconditionally whenever _next was truthy. The fix introduces Django's built-in url_has_allowed_host_and_scheme() checked against settings.ALLOWED_HOSTS, plus iri_to_uri() for safe IRI encoding, which are the canonical Django-recommended defenses against this class of flaw.
RemediationAI
Apply the upstream fix from commit 734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6 (https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6), which adds url_has_allowed_host_and_scheme() and iri_to_uri() guards to all four notification view handlers. No tagged release version incorporating this fix has been independently confirmed at time of analysis; operators should apply the patch commit directly until a versioned release is available. As a compensating control, configure a reverse proxy or WAF rule to reject requests to /notifications/ endpoints where the next query parameter value contains a scheme or hostname not matching the application's own domain - this prevents external redirect injection without modifying application code, though it may require tuning to avoid blocking legitimate relative-URL next values.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today