PT-2026-3915 · Horilla · Horilla

Whoisshuvam · Publicado 2026-01-22 · Atualizado 2026-01-22 · CVE-2026-24039

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0

Description Horilla, a Human Resource Management System (HRMS), contains an Improper Access Control issue. A low-privileged employee can self-approve documents they have uploaded, despite the document-approval user interface being intended for administrator or high-privilege roles only. This is due to an insufficient server-side authorization check on the approval endpoint. Exploitation allows users with employee-level permissions to alter application state reserved for administrators, potentially undermining the integrity of HR processes. The vulnerable endpoint is the approval endpoint. The vulnerable action involves modifying the approval status of a document using the user id associated with the employee.

Recommendations Update to version 1.5.0 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-24039

GHSA-99MQ-MHWV-W9QX

Produtos afetados

Horilla

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24039.json · Exploit
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Nota
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99mq-mhwv-w9qx · Aviso do Fabricante
• https://twitter.com/lsof/status/2014399149379133469 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014210221493633346 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014196242474037472 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24039 · Aviso do Fabricante
• https://t.me/CVEtracker/42742 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24039 · Nota de Segurança