Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-40865 Insecure Direct Object Reference in Horilla HRMS 1.5.0 Employee Document Viewer https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40865
Post summary
A brief disclosure of an IDOR issue in Horilla HRMS 1.5.0, with no PoC, exploit, patch, or exploitation evidence presented.
CVE-2026-40865 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any au… https://www.cve.org/CVERecord?id=CVE-2026-40865
Post summary
The note reports a newly disclosed CVE (CVE-2026-40865) describing an IDOR flaw in Horilla HRMS version 1.5.0, but it offers no PoC, exploitation details, patch information, or claims of false positive.
Pleased to share that 3 of my recent security findings in Horilla are now disclosed with CVEs: CVE-2026-40867 CVE-2026-40866 CVE-2026-40865 #CyberSecurity #SecurityResearch #WebSecurity #CVE #AppSec
Post summary
The author announces three new CVE disclosures for Horilla, but provides no further technical details or evidence of exploitation.