PT-2026-3912 · Horilla · Horilla

Whoisshuvam · CVE-2026-24036 · Published 2026-01-22 · Updated 2026-01-22

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions 1.4.0 through 1.4.9

Description Horilla, a Human Resource Management System (HRMS), has an issue where unpublished job postings are exposed. This occurs through the ''/recruitment/recruitment-details//'' endpoint without requiring authentication. The response includes draft job titles, descriptions, and the application link, allowing unauthenticated users to view unpublished roles and access the application workflow. This unauthorized access can lead to the leakage of sensitive internal hiring information and candidate confusion.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-24036

GHSA-Q4XR-W96P-3VG7

Affected Products

Horilla

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24036.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-q4xr-w96p-3vg7 · Vendor Advisory
• https://github.com/horilla-opensource/horilla/commit/9a585a1588431499092a49d7e82cb77daa4d99ee · Patch
• https://osv.dev/vulnerability/CVE-2026-24036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24036 · Security Note
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Note
• https://t.me/cveNotify/149519 · Telegram Post
• https://twitter.com/CVEnew/status/2014182476240003447 · Twitter Post
• https://t.me/CVEtracker/42739 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014217900890947762 · Twitter Post