CVE-2026-24039: Horilla HRMS Auth Bypass Vulnerability

CVE-2026-24039 Overview

CVE-2026-24039 is an Improper Access Control vulnerability affecting Horilla, a free and open source Human Resource Management System (HRMS). The vulnerability exists in version 1.4.0 and allows low-privileged employees to self-approve documents they have uploaded, bypassing the authorization controls intended for administrator roles.

Critical Impact

Low-privileged employees can circumvent HR document approval workflows, potentially allowing submission of unvetted credentials, certifications, or supporting materials without proper administrative review.

Affected Products

• Horilla HRMS version 1.4.0

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-24039 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-24039

Vulnerability Analysis

This vulnerability stems from an insufficient server-side authorization check on the document approval endpoint within Horilla HRMS. The document-approval UI is intended to be restricted to administrator or high-privilege roles only; however, the backend fails to properly validate the requesting user's permissions before processing approval state changes.

The attack can be executed remotely over the network and requires low privileges (an authenticated employee account). No user interaction is required for exploitation. The vulnerability impacts the integrity of document approval workflows, though it does not directly expose confidential data or affect system availability.

Root Cause

The root cause is classified as CWE-284 (Improper Access Control). The application's approval endpoint lacks proper server-side authorization validation, trusting the client-side UI restrictions to prevent unauthorized access. This design flaw allows any authenticated user to directly interact with the approval endpoint, bypassing the intended role-based access controls.

Attack Vector

An attacker with standard employee-level credentials can exploit this vulnerability by directly sending requests to the document approval endpoint. Since the server does not properly verify that the requesting user has administrative privileges, the attacker can modify the approval status of their own uploaded documents.

The exploitation workflow involves:

1. Authenticating to Horilla HRMS with a standard employee account
2. Uploading a document requiring administrative approval
3. Directly submitting an approval request to the vulnerable endpoint
4. The server processes the approval without verifying administrative privileges

This undermines the integrity of HR processes such as credential verification, certification validation, and supporting material review, potentially enabling submission of fraudulent or unvetted documents into the HR system.

Detection Methods for CVE-2026-24039

Indicators of Compromise

• Document approval records where the approving user is the same as the document uploader
• Unusual patterns of document self-approvals by non-administrative users
• Access logs showing direct API calls to approval endpoints from employee-level accounts

Detection Strategies

• Implement logging and alerting for document approval actions that match the document owner
• Monitor for approval endpoint access by users without administrative role assignments
• Review audit trails for documents that were approved without going through the standard workflow

Monitoring Recommendations

• Enable detailed audit logging for all document approval actions including user ID and role
• Configure alerts for approval actions performed by users outside the designated approver group
• Periodically audit approved documents to verify approver credentials match expected administrative personnel

How to Mitigate CVE-2026-24039

Immediate Actions Required

• Upgrade Horilla HRMS to version 1.5.0 or later immediately
• Audit all documents approved since deploying version 1.4.0 to identify potential self-approvals
• Review HR processes for any documents that may have bypassed proper approval workflows

Patch Information

The vulnerability has been fixed in Horilla HRMS version 1.5.0. Organizations should update to this version immediately to remediate the access control weakness. For more details, see the GitHub Release 1.5.0 and the GitHub Security Advisory GHSA-99mq-mhwv-w9qx.

Workarounds

• Restrict network access to the Horilla HRMS application to trusted networks until patching is complete
• Implement additional access controls at the network or web application firewall level to filter approval endpoint requests
• Manually review and re-approve any critical documents while using the vulnerable version