PT-2026-40245 · Horilla · Horilla Hrm

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-41513

NVD

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-41513

Affected Products

Horilla Hrm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41513 · Security Note
• https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6 · Note
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw · Note