CVE-2026-40865

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40865

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40865.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40865

Aliases

GHSA-85cj-fwjh-fjv7

Published

2026-04-21T18:14:19.523Z

Modified

2026-07-15T01:49:07.183830728Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>

Details

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.

Database specific

{
    "cwe_ids": [
        "CWE-284",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40865.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/horilla/horilla-hr

Affected ranges

Type

GIT

Repo

https://github.com/horilla/horilla-hr

Events

Introduced

61bd5173220d19925ad8220db9152a75c881ea73

Last affected

61bd5173220d19925ad8220db9152a75c881ea73

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "1.5.0"
        }
    ]
}

Affected versions

1.*

1.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40865.json"