CVE-2026-24035: Horilla HRMS Auth Bypass Vulnerability

CVE-2026-24035 Overview

CVE-2026-24035 is an Improper Access Control vulnerability affecting Horilla, a free and open source Human Resource Management System (HRMS). The vulnerability allows any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations.

Critical Impact

Any authenticated user can manipulate the employee_id parameter to upload documents to any employee's profile, potentially enabling data manipulation, impersonation attacks, or unauthorized modification of employee records.

Affected Products

• Horilla HRMS version 1.4.0
• Horilla HRMS versions between 1.4.0 and 1.5.0

Discovery Timeline

• January 22, 2026 - CVE-2026-24035 published to NVD
• January 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24035

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating a failure to properly restrict access to a resource. The affected file upload functionality in Horilla HRMS does not adequately verify that the authenticated user has permission to upload documents for the specified employee. When a user submits a file upload request, the application accepts the employee_id parameter from the client without validating whether the requesting user has the authority to perform actions on behalf of that employee.

The attack requires only basic authentication to the Horilla application, meaning any employee with valid credentials can exploit this vulnerability. While the integrity impact is limited to unauthorized document uploads, this could facilitate social engineering attacks, compliance violations, or serve as a stepping stone for more sophisticated attacks within the organization.

Root Cause

The root cause is insufficient server-side authorization checks on the file upload endpoint. The application trusts the client-supplied employee_id parameter without verifying that the authenticated user is either uploading to their own profile or has administrative privileges to manage other employees' documents. This represents a classic Insecure Direct Object Reference (IDOR) pattern where user-controlled input directly references objects without proper authorization validation.

Attack Vector

An authenticated attacker can exploit this vulnerability by intercepting a legitimate document upload request and modifying the employee_id parameter to target a different employee. The attack is network-based and requires low complexity to execute. No user interaction is required beyond the attacker's own actions.

The exploitation flow involves:

1. An attacker authenticates to the Horilla application with valid employee credentials
2. The attacker initiates a document upload request
3. Using browser developer tools or a proxy tool, the attacker modifies the employee_id parameter in the request to reference another employee's ID
4. The server accepts the upload without validating the attacker's authorization
5. The malicious document is now associated with the victim employee's profile

For detailed technical information, refer to the GitHub Security Advisory GHSA-fm3f-xpgx-8xr3.

Detection Methods for CVE-2026-24035

Indicators of Compromise

• Document uploads where the uploading user's ID does not match the target employee_id in the request
• Unusual patterns of document uploads targeting multiple employee profiles from a single user session
• File upload activity from users who typically do not perform such operations
• Rapid succession of document uploads to different employee profiles

Detection Strategies

• Implement application-level logging that captures both the authenticated user ID and the target employee_id for all document upload operations
• Create alerts for mismatches between the authenticated user and the target employee in upload requests
• Deploy web application firewall (WAF) rules to detect parameter manipulation attempts on sensitive endpoints
• Review audit logs for historical exploitation attempts by comparing upload timestamps with user session activity

Monitoring Recommendations

• Enable detailed audit logging on all document management functions within Horilla
• Monitor for anomalous API call patterns, particularly on file upload endpoints
• Implement real-time alerting for any document uploads where the session user differs from the target employee
• Regularly audit document ownership records to identify unauthorized modifications

How to Mitigate CVE-2026-24035

Immediate Actions Required

• Upgrade Horilla HRMS to version 1.5.0 or later immediately
• Review recent document upload logs to identify potential exploitation
• Audit employee document records for unauthorized or suspicious uploads
• Implement additional network-level access controls while patching is in progress

Patch Information

The vulnerability has been fixed in Horilla HRMS version 1.5.0. The patch implements proper server-side authorization checks to ensure that users can only upload documents to their own profiles unless they have explicit administrative permissions.

For patch details, see the Horilla 1.5.0 Release Notes.

Workarounds

• Restrict access to the document upload functionality to only administrative users until patching is complete
• Implement a reverse proxy rule to validate that the employee_id parameter matches the authenticated user's ID
• Enable enhanced logging and monitoring to detect exploitation attempts
• Consider temporarily disabling the document upload feature if the business impact is acceptable

# Example: Restrict document upload endpoint access via reverse proxy (nginx)
location /api/documents/upload {
    # Only allow requests from admin IP ranges temporarily
    allow 10.0.0.0/8;
    deny all;
    
    # Pass to application
    proxy_pass http://horilla_backend;
}