CVE-2026-40867: Horilla HRMS Auth Bypass Vulnerability

CVE-2026-40867 Overview

CVE-2026-40867 is a broken access control vulnerability discovered in Horilla, a free and open source Human Resource Management System (HRMS). The vulnerability exists in the helpdesk attachment viewer component and allows any authenticated user to view attachments from other tickets by simply manipulating the attachment ID parameter. This security flaw can expose sensitive support files and internal documents across unrelated users or teams within the organization.

Critical Impact

Authenticated attackers can access confidential HR documents, support tickets, and internal files belonging to other users by exploiting insecure direct object references in the helpdesk module.

Affected Products

• Horilla HRMS version 1.5.0

Discovery Timeline

• 2026-04-21 - CVE-2026-40867 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40867

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), which occurs when software fails to properly restrict access to resources. In the context of Horilla HRMS, the helpdesk attachment viewer does not validate whether the requesting user has authorization to view the requested attachment.

The core issue stems from the application trusting user-supplied input (the attachment ID) without verifying that the authenticated user has legitimate access to the referenced resource. This is a classic example of an Insecure Direct Object Reference (IDOR) vulnerability, where internal implementation objects are exposed to users through predictable identifiers.

The network-based attack vector with low complexity makes this vulnerability particularly concerning for organizations using Horilla HRMS, as any authenticated user—regardless of their role or permissions—can potentially access sensitive HR documents, employee records, and internal communications stored as helpdesk attachments.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the helpdesk attachment retrieval functionality. When a user requests an attachment, the application only verifies that the user is authenticated but fails to validate whether the user has permission to access the specific attachment being requested.

The application directly uses the user-supplied attachment ID to retrieve files from the backend storage without cross-referencing the attachment ownership against the requesting user's identity or ticket associations. This missing authorization layer allows horizontal privilege escalation between users of the same system.

Attack Vector

The attack leverages the network-accessible helpdesk attachment endpoint. An attacker with valid credentials to the Horilla HRMS system can exploit this vulnerability by:

1. Authenticating to the Horilla HRMS application with any valid user account
2. Navigating to a helpdesk ticket and observing the attachment URL structure
3. Identifying the attachment ID parameter in the request
4. Systematically modifying the attachment ID to enumerate and access attachments from other users' tickets
5. Retrieving sensitive documents, HR records, or confidential communications belonging to other employees

The attack requires no special tools or technical expertise—only a web browser and valid authentication credentials. Since attachment IDs are typically sequential integers, an attacker can easily iterate through ID values to discover and exfiltrate all accessible attachments in the system.

Detection Methods for CVE-2026-40867

Indicators of Compromise

• Unusual patterns of attachment access requests from a single user account
• Sequential or enumerated attachment ID requests in access logs
• User accounts accessing attachments for tickets they did not create or are not assigned to
• High volume of 200 OK responses for attachment requests from a single session

Detection Strategies

• Implement logging and alerting for attachment access patterns that deviate from normal user behavior
• Monitor for rapid sequential requests to the attachment endpoint with incrementing ID values
• Deploy application-level intrusion detection to identify IDOR attack patterns
• Review access logs for users viewing attachments outside their organizational unit or team

Monitoring Recommendations

• Enable detailed request logging on the helpdesk attachment endpoint
• Set up alerts for attachment access from users who are not ticket owners or assignees
• Implement rate limiting on attachment retrieval to slow enumeration attacks
• Conduct regular access log reviews to identify potential exploitation attempts

How to Mitigate CVE-2026-40867

Immediate Actions Required

• Upgrade Horilla HRMS to a patched version as soon as one becomes available
• Implement additional authorization checks at the web application firewall level if possible
• Restrict access to the helpdesk module to only essential personnel until patched
• Audit existing attachment access logs for signs of exploitation

Patch Information

Organizations should monitor the GitHub Security Advisory for official patch releases from the Horilla development team. The advisory provides detailed information about the vulnerability and remediation guidance.

Workarounds

• Implement network-level access controls to restrict helpdesk module access to trusted IP ranges
• Deploy a web application firewall rule to validate attachment requests against user permissions
• Temporarily disable the helpdesk attachment feature if not business-critical
• Consider migrating sensitive documents to an external secure document management system until patched