PT-2026-3915 · Horilla · Horilla

Whoisshuvam · Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-24039

Positive Technologies · (AI Summary)

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0

Description Horilla, a Human Resource Management System (HRMS), contains an Improper Access Control issue. A low-privileged employee can self-approve documents they have uploaded, despite the document-approval user interface being intended for administrator or high-privilege roles only. This is due to an insufficient server-side authorization check on the approval endpoint. Exploitation allows users with employee-level permissions to alter application state reserved for administrators, potentially undermining the integrity of HR processes. The vulnerable endpoint is the approval endpoint. The vulnerable action involves modifying the approval status of a document using the

user id

associated with the employee.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-24039

GHSA-99MQ-MHWV-W9QX

Affected Products

Horilla

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24039.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-99mq-mhwv-w9qx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24039 · Security Note
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Note
• https://twitter.com/lsof/status/2014399149379133469 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014210221493633346 · Twitter Post
• https://twitter.com/CVEnew/status/2014196242474037472 · Twitter Post
• https://t.me/CVEtracker/42742 · Telegram Post