CVE-2026-3049: Horilla Open Redirect Vulnerability

CVE-2026-3049 Overview

An open redirect vulnerability has been identified in horilla-opensource Horilla CRM up to version 1.0.2. This security flaw exists in the get function within the horilla_generics/global_search.py file, which is part of the Query Parameter Handler component. The vulnerability allows attackers to manipulate the prev_url argument to redirect users to malicious external websites. This attack can be executed remotely over the network, and a public proof-of-concept exploit is available.

Critical Impact

Attackers can exploit this open redirect to conduct phishing campaigns, credential theft, or malware distribution by redirecting users from trusted Horilla CRM instances to attacker-controlled domains.

Affected Products

• Horilla CRM versions up to 1.0.2
• horilla-opensource horilla (all installations prior to patch commit 730b5a44ff060916780c44a4bdbc8ced70a2cd27)

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-3049 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-3049

Vulnerability Analysis

This open redirect vulnerability (CWE-601) occurs due to insufficient validation of the prev_url parameter in the global search redirect flow. When users perform searches within Horilla CRM, the application stores the previous URL to enable navigation back to the original page. However, the application fails to verify whether the redirect destination is within the trusted domain before processing the redirect request.

The vulnerability is exploitable over the network without requiring any authentication, though user interaction is necessary for successful exploitation. An attacker can craft a malicious URL containing the vulnerable prev_url parameter that points to an external malicious site. When an unsuspecting user clicks the crafted link, they are redirected from the legitimate Horilla CRM application to the attacker's controlled destination.

Root Cause

The root cause of this vulnerability is the absence of host validation on the prev_url parameter before performing redirects. The application accepts arbitrary URLs without checking if they belong to allowed hosts, enabling attackers to redirect users to external domains. The fix introduces Django's url_has_allowed_host_and_scheme function to validate redirect URLs before processing them.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a malicious link containing the Horilla CRM domain with a crafted prev_url parameter pointing to an external malicious site. The victim, trusting the legitimate domain in the URL, clicks the link and is subsequently redirected to the attacker's site. This technique is commonly used in phishing attacks where the malicious destination mimics a login page to harvest credentials.

# Security patch from horilla_generics/global_search.py
# Adds URL validation to prevent open redirect attacks

 from django.shortcuts import redirect, render
 from django.template.loader import render_to_string
 from django.urls import reverse_lazy
+from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.safestring import mark_safe
 from django.views import View

Source: GitHub Commit Update

Detection Methods for CVE-2026-3049

Indicators of Compromise

• Unusual redirect patterns in web server access logs involving the global search endpoint
• HTTP requests containing external URLs in the prev_url query parameter
• Users reporting unexpected redirects to unfamiliar websites after interacting with Horilla CRM
• Phishing reports referencing legitimate Horilla CRM URLs as the initial link

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing external domains in query parameters
• Implement URL pattern analysis to detect redirect attempts to non-whitelisted domains
• Review access logs for global search endpoints with suspicious prev_url values
• Deploy browser-based phishing detection tools for end-user protection

Monitoring Recommendations

• Enable verbose logging for all redirect operations within the application
• Configure alerting for high volumes of redirect requests to external domains
• Implement real-time monitoring of the global_search.py endpoint activity
• Conduct regular security assessments of URL handling mechanisms

How to Mitigate CVE-2026-3049

Immediate Actions Required

• Upgrade Horilla CRM to version 1.0.3 or later immediately
• If immediate upgrade is not possible, apply the security patch identified by commit 730b5a44ff060916780c44a4bdbc8ced70a2cd27
• Review access logs for evidence of exploitation attempts
• Notify users about potential phishing attacks leveraging this vulnerability

Patch Information

The vulnerability has been addressed in Horilla CRM version 1.0.3. The patch introduces proper URL validation using Django's built-in url_has_allowed_host_and_scheme function to ensure redirect destinations are within trusted hosts. Organizations should upgrade to version 1.0.3 or apply the patch commit 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The updated release is available on the GitHub Release v1.0.3 page.

Workarounds

• Deploy a web application firewall (WAF) rule to block requests with external URLs in the prev_url parameter
• Implement a reverse proxy rule to sanitize or reject redirect requests to untrusted domains
• Restrict access to the affected global search functionality until patching is complete
• Educate users about verifying destination URLs before clicking links, even from trusted sources

# Example WAF rule to block external redirects (ModSecurity)
SecRule ARGS:prev_url "^https?://(?!yourdomain\.com)" \
    "id:1001,phase:1,deny,status:403,msg:'Blocked potential open redirect attempt'"