PT-2026-3912 · Horilla · Horilla

Whoisshuvam · Publicado 2026-01-22 · Atualizado 2026-01-22 · CVE-2026-24036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions 1.4.0 through 1.4.9

Description Horilla, a Human Resource Management System (HRMS), has an issue where unpublished job postings are exposed. This occurs through the ''/recruitment/recruitment-details//'' endpoint without requiring authentication. The response includes draft job titles, descriptions, and the application link, allowing unauthenticated users to view unpublished roles and access the application workflow. This unauthorized access can lead to the leakage of sensitive internal hiring information and candidate confusion.

Recommendations Update to version 1.5.0 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-24036

GHSA-Q4XR-W96P-3VG7

Produtos afetados

Horilla

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24036.json · Exploit
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Nota
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7 · Aviso do Fabricante
• https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee · Correção
• https://t.me/cveNotify/149519 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014182476240003447 · Publicação no Twitter
• https://t.me/CVEtracker/42739 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24036 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24036 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2014217900890947762 · Publicação no Twitter