The Horilla HRMS system has vulnerabilities that allow authenticated users to access other employees' documents and view attachments from other tickets.

🚨 EUVD-2026-24231 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: horilla 🏢 Vendor: horilla-opensource 📅 Updated: 2026-04-21 📝 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the do... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24231 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24235 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: horilla 🏢 Vendor: horilla-opensource 📅 Updated: 2026-04-21 📝 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attac... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24235 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24234 📊 Score: 8.6/10 (CVSS v3.1) 📦 Product: horilla 🏢 Vendor: horilla-opensource 📅 Updated: 2026-04-21 📝 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s d... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24234 #cybersecurity #infosec #euvd #cve #vulnerability