CVE-2026-40867: Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-06-17
Weakness: CWE-284

Description

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.

Affected products

horilla-opensource horilla: 1.5.0

References

https://github.com/horilla/horilla-hr/security/advisories/GHSA-j6qp-j853-qrff
https://github.com/horilla/horilla-hr/security/advisories/GHSA-j6qp-j853-qrff

Get alerted when CVE-2026-40867 or the next vulnerability affects your stack