CVE-2026-40867: falha de alta gravidade em horilla-opensource horilla
Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
horilla-opensource · horillaCVEs relacionadas — horilla-opensource horilla
No mesmo produto, das mais perigosas para as menos.
CVE-2025-48868HIGHHorilla vulnerable to authenticated RCE via eval() in project_bulk_archiveEPSS 2.5%CVE-2026-24036MEDIUMHorilla Exposes Unpublished Job Disclosures through Unauthenticated APIEPSS 0.5%CVE-2026-24038HIGHHorilla HR has 2FA Bypass through its OTP Handling LogicEPSS 0.5%CVE-2026-24010HIGHHorilla has HTML Injection Issue that, with Phishing, Leads to Account TakeoverEPSS 0.5%CVE-2026-3049MEDIUMhorilla-opensource horilla Query Parameter global_search.py get redirectEPSS 0.4%CVE-2025-48869HIGHHorilla Unauthorized Access to Candidate Resume Files Due to Broken Access ControlEPSS 0.4%