Horilla Hr
Monthly
Open redirect in Horilla HR and CRM version 1.5.0 enables authenticated attackers to weaponize trusted application notification links into phishing redirects targeting other users. Four notification endpoint handlers (mark_all_as_read, mark_as_read, mark_as_unread, delete) in notifications/views.py pass the unvalidated next GET parameter directly to Django's redirect() without checking the destination host, allowing external URL injection. SSVC confirms a proof-of-concept exists; exploitation is not automatable and the vulnerability is not listed in CISA KEV, placing real-world risk firmly in the social-engineering category rather than direct system compromise.
Open redirect in Horilla HR and CRM version 1.5.0 enables authenticated attackers to weaponize trusted application notification links into phishing redirects targeting other users. Four notification endpoint handlers (mark_all_as_read, mark_as_read, mark_as_unread, delete) in notifications/views.py pass the unvalidated next GET parameter directly to Django's redirect() without checking the destination host, allowing external URL injection. SSVC confirms a proof-of-concept exists; exploitation is not automatable and the vulnerability is not listed in CISA KEV, placing real-world risk firmly in the social-engineering category rather than direct system compromise.