CVE-2026-24035

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24035", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.776Z", "datePublished": "2026-01-22T02:43:10.884Z", "dateUpdated": "2026-01-22T12:41:56.958Z"}, "containers": {"cna": {"title": "Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3"}, {"name": "https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing", "tags": ["x_refsource_MISC"], "url": "https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing"}, {"name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"version": ">= 1.4.0, < 1.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T02:43:10.884Z"}, "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue."}], "source": {"advisory": "GHSA-fm3f-xpgx-8xr3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:41:38.289236Z", "id": "CVE-2026-24035", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:41:56.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24035", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T12:41:38.289236Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:41:52.625Z"}}], "cna": {"title": "Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee", "source": {"advisory": "GHSA-fm3f-xpgx-8xr3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "horilla-opensource", "product": "horilla", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "references": [{"url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3", "name": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing", "name": "https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "name": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T02:43:10.884Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24035", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:41:56.958Z", "dateReserved": "2026-01-20T22:30:11.776Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T02:43:10.884Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "horilla", "vendor": "horilla-opensource", "versions": [{"status": "affected", "version": ">= 1.4.0, < 1.5.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:horilla:horilla:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "55143854-C369-4CAA-B671-90EFC9170F64", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue."}, {"lang": "es", "value": "Horilla es un Sistema de Gesti\u00f3n de Recursos Humanos (HRMS) gratuito y de c\u00f3digo abierto. Existe una vulnerabilidad de control de acceso inadecuado en el software Horilla HR a partir de la versi\u00f3n 1.4.0 y anterior a la versi\u00f3n 1.5.0, que permite a cualquier empleado autenticado subir documentos en nombre de otro empleado sin la autorizaci\u00f3n adecuada. Esto ocurre debido a una validaci\u00f3n insuficiente del lado del servidor del par\u00e1metro employee_id durante las operaciones de carga de archivos, lo que permite a cualquier empleado autenticado subir documentos en nombre de cualquier empleado. La versi\u00f3n 1.5.0 corrige el problema."}], "id": "CVE-2026-24035", "lastModified": "2026-06-17T10:22:29.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24035", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:41:38.289236Z", "version": "2.0.3"}}]}, "published": "2026-01-22T04:15:59.453", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit"], "url": "https://drive.google.com/file/d/1i00-NnipvxH8bGY-SyqEjnDQfxIbVGRR/view?usp=sharing"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/horilla-opensource/horilla/releases/tag/1.5.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/horilla-opensource/horilla/security/advisories/GHSA-fm3f-xpgx-8xr3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:55:08.809435+00:00", "value": {"mitigation_remediation": ["Upgrade to Horilla version\u00a01.5.0 or later, which contains the vendor\u2011supplied fix.", "Re\u2011configure upload endpoints to reject any employee_id value that does not match the authenticated user\u2019s ID, ensuring strict access control.", "Audit and restrict upload permissions in the HRMS role\u2011based access controls so that only authorized personnel can upload documents."], "summary": {"action": "Patch Now", "impact": "Unauthorized document upload"}, "threat_synthesis": {"affected_systems": "The affected product is Horilla \u2013 the open\u2011source HRMS provided by horilla\u2011opensource. Versions starting at 1.4.0 and up to, but not including, 1.5.0 are vulnerable. Version 1.5.0 includes the fix and is considered safe.", "description_and_impact": "Horilla HR software contains an improper access control flaw that allows any authenticated employee to upload documents on behalf of another employee. The vulnerability stems from insufficient server\u2011side validation of the employee_id parameter during file upload, enabling the attacker to place files in the context of other users. This can compromise confidentiality and integrity of employee records and provide a vector for data leakage or malicious file distribution.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity; exploitation requires only authentication of a legitimate HRMS user, so an insider or compromised account can easily abuse the issue. The EPSS score is below 1\u202f%, suggesting low overall likelihood of public exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, once an authenticated user can upload a file as another employee, they could inject malicious content or falsify records, making mitigation a priority. The attack vector is inferred to be the web interface or API where file uploads occur, and the vulnerability does not provide remote code execution."}}}}, "created": "2026-01-22T10:08:17.967174+00:00", "updated": "2026-04-18T04:00:08.419825+00:00", "vendors": ["horilla", "horilla$PRODUCT$horilla"]}