Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-40867 Broken Access Control in Horilla HRMS 1.5.0 Helpdesk Attachment Viewer https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40867
Post summary
The text identifies a new CVE for a broken access control flaw in Horilla HRMS and provides a link to a vulnerability database entry.
CVE-2026-40867 Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows an… https://www.cve.org/CVERecord?id=CVE-2026-40867
Post summary
The post reveals a broken access control flaw in Horilla HRMS 1.5.0 affecting the helpdesk attachment viewer.
Pleased to share that 3 of my recent security findings in Horilla are now disclosed with CVEs: CVE-2026-40867 CVE-2026-40866 CVE-2026-40865 #CyberSecurity #SecurityResearch #WebSecurity #CVE #AppSec
Post summary
The user announced the disclosure of three new CVEs in Horilla but provided no further technical or exploit information.