CVE-2026-63431: Horilla HR Software Auth Bypass Vulnerability

CVE-2026-63431 Overview

CVE-2026-63431 is a missing authorization vulnerability [CWE-862] in Horilla, an open-source Human Resources (HR) and Customer Relationship Management (CRM) application. The flaw resides in payroll/views/component_views.py and affects versions 1.5.0-85 and earlier. Three view functions, allowances_deductions_tab, view_single_allowance, and view_single_deduction, load records using client-supplied identifiers without verifying ownership or payroll-view permissions. An authenticated employee can substitute emp_id, allowance_id, or deduction_id values to read other employees' payroll data, including salary structures, allowances, deductions, loan disbursements, and repayment schedules.

Critical Impact

Any authenticated employee can enumerate and read confidential payroll records belonging to other staff without holding payroll permissions.

Affected Products

• Horilla HR and CRM software
• Horilla versions 1.5.0-85 and earlier
• payroll/views/component_views.py module

Discovery Timeline

• 2026-09-25 - CVE-2026-63431 published to the National Vulnerability Database (NVD)
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-63431

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) stemming from missing object-level authorization. In the affected Horilla release, three endpoints in payroll/views/component_views.py accept primary-key style parameters directly from the HTTP request and fetch the corresponding database records without verifying that the caller owns the record or possesses payroll-view permissions.

The exposed data is sensitive and regulated under most privacy frameworks. It includes salary structures, per-period allowance and deduction amounts, personal loan disbursements, and repayment schedules. Because exploitation only requires a valid employee login, the barrier to abuse inside an organization is low.

At the time of publication, no complete fixed release is available. A partial remediation commit on the project repository introduces the handle_no_permission decorator import, indicating an in-progress permission enforcement effort.

Root Cause

The three view functions trust identifiers submitted by the client. They call model lookups such as Allowance.objects.get(id=allowance_id) and render the associated payroll data without validating that the authenticated user is the record owner or holds the payroll.view_* permission. The absence of a permission decorator and the lack of an ownership check in the queryset produces the IDOR condition classified under [CWE-862].

Attack Vector

An attacker needs only standard employee credentials. After authenticating, the attacker requests the vulnerable payroll views and iterates through numeric identifiers for emp_id, allowance_id, or deduction_id. Each successful request returns the targeted employee's payroll record. The attack is executed over the network against the application's HTTP endpoints and does not require user interaction from the victim.

# Patch excerpt from payroll/views/component_views.py
 from base.models import Company
 from employee.models import Employee, EmployeeWorkInformation
 from horilla.decorators import (
+    handle_no_permission,
     hx_request_required,
     login_required,
     owner_can_enter,

Source: GitHub Commit a17fdbb. The diff adds the handle_no_permission decorator import, groundwork for enforcing permission checks on the affected views.

Detection Methods for CVE-2026-63431

Indicators of Compromise

• Sequential or enumerative HTTP GET requests from a single authenticated session targeting /payroll/ routes with varying emp_id, allowance_id, or deduction_id values.
• Access to allowances_deductions_tab, view_single_allowance, or view_single_deduction by user accounts that do not hold payroll roles.
• Spikes in payroll-view responses correlated with a single low-privilege session identifier.

Detection Strategies

• Enable Django request logging and alert on authenticated users accessing payroll endpoints when their role is not in the payroll group.
• Baseline normal payroll endpoint access per user and alert on deviations in record diversity (many distinct emp_id values queried in a short window).
• Perform application-layer authorization testing against the three named views as part of regression and penetration testing.

Monitoring Recommendations

• Centralize web and application logs for the Horilla instance and retain request parameters for payroll routes.
• Review database query audit trails for payroll tables and correlate with the acting user to identify cross-employee access.
• Monitor for abnormal response sizes and iteration patterns on payroll views that suggest ID enumeration.

How to Mitigate CVE-2026-63431

Immediate Actions Required

• Restrict network access to the Horilla application to trusted internal users while a complete fix is pending.
• Audit existing payroll endpoint access logs for cross-employee reads by non-payroll accounts.
• Reduce payroll data exposure by disabling the affected views at the reverse proxy if they are not operationally required.

Patch Information

No complete fixed version was available at the time of this review. A remediation commit is in progress in the project repository. See the GitHub Security Advisory GHSA-c38j-fg3w-7rph and the GitHub Commit Overview for the status of the fix. Track the advisory and apply the vendor patch once a complete release is published.

Workarounds

• Apply the upstream permission decorators to allowances_deductions_tab, view_single_allowance, and view_single_deduction locally, enforcing login_required, permission_required('payroll.view_*'), and an ownership check against emp_id.
• Place the Horilla application behind an authenticating reverse proxy that restricts payroll routes to HR staff by IP or group membership.
• Temporarily remove or 403 the three vulnerable URL routes via web server rules until the official patch is applied.

# Example nginx rule to block the vulnerable payroll routes until patched
location ~ ^/payroll/(allowances_deductions_tab|view_single_allowance|view_single_deduction) {
    allow 10.0.0.0/8;        # HR subnet
    deny all;
    return 403;
}