CVE-2026-41513: medium-severity vulnerability in horilla-hr
Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.3%
Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
horilla · horilla-hrRelated CVEs — horilla-hr
In the same product, most dangerous first.
CVE-2026-63432MEDIUMHorilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server MetadataEPSS 0.4%CVE-2026-96795HIGHHorilla: Authenticated RCE in Horilla List-View ExportEPSS 0.4%CVE-2026-71483HIGHHorilla: Reflected Cross-Site Scripting (XSS) in Employee Filter ViewEPSS 0.3%CVE-2026-86066MEDIUMHorilla attendance approval endpoint is vulnerable to cross-site request forgeryEPSS 0.3%CVE-2026-63431MEDIUMHorilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)EPSS 0.2%