CVE-2026-40865: Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-10-25
Weakness: CWE-284

Description

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.

Affected products

horilla-opensource horilla: 1.5.0

References

https://github.com/horilla/horilla-hr/security/advisories/GHSA-85cj-fwjh-fjv7
https://github.com/horilla/horilla-hr/security/advisories/GHSA-85cj-fwjh-fjv7

Get alerted when CVE-2026-40865 or the next vulnerability affects your stack