CVE-2026-24035 Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee

Medium 4.3 Published 22 Jan 2026 Updated 22 Jan 2026

Authenticated users can upload documents for other employees due to missing authorization checks, allowing unauthorized data modification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24035?

CVE-2026-24035 is a medium-severity missing authorization vulnerability in horilla-opensource horilla, published on 22 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Horilla is a free and open source Human Resource Management System (HRMS). An Improper Access Control vulnerability exists in Horilla HR Software starting in version 1.4.0 and prior to version 1.5.0, allowing any authenticated employee to upload documents on behalf of another employee without proper authorization. This occurs due to insufficient server-side validation of the employee_id parameter during file upload operations, allowing any authenticated employee to upload document in behalf of any employee. Version 1.5.0 fixes the issue.

Weakness: CWE-284

Which versions are affected by CVE-2026-24035?

It affects 1 product.

Products include Horilla Horilla.

How do I fix CVE-2026-24035?

No fix has been published for CVE-2026-24035 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24035 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24035 exists.

Sources

Also known as GHSA-fm3f-xpgx-8xr3.