CVE-2026-40865
Vulnerability Description
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-284
Source
NVD
Vendor
horilla-opensource
Product
horilla
Discussion (0)
Add Comment
No comments yet. Be the first!