Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee

Description

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.

Scores

EPSS (exploitation in 30 days)

0.31% · top 76% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-284: Improper Access Control (opens in a new tab)All about CWE-284 and its CVEs

Affected products

• horilla-opensource · horilla

  • affected >= 1.4.0, < 1.5.0

References (3)

• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3 (opens in a new tab)x_refsource_CONFIRM
• https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing (opens in a new tab)x_refsource_MISC
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-24035](https://trackcve.app/badge/CVE-2026-24035.svg)](https://trackcve.app/cve/CVE-2026-24035)

Record last updated 22 Jan 2026, 12:41 UTC.