Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-40866 Insecure Direct Object Reference in Horilla HRMS 1.5.0 Employee Document Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40866
Post summary
The text announces the discovery of CVE‑2026‑40866, describing it as an insecure direct object reference in Horilla HRMS 1.5.0, but provides no further technical or exploit details.
CVE-2026-40866 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allo… https://www.cve.org/CVERecord?id=CVE-2026-40866
Post summary
The text discloses an IDOR vulnerability in Horilla HRMS 1.5.0 (CVE-2026-40866), but does not mention any PoC, exploit code, active exploitation, or available patch/workaround.
Pleased to share that 3 of my recent security findings in Horilla are now disclosed with CVEs: CVE-2026-40867 CVE-2026-40866 CVE-2026-40865 #CyberSecurity #SecurityResearch #WebSecurity #CVE #AppSec
Post summary
The author announces the public disclosure of three CVEs for Horilla, without providing additional technical or exploit details.