CVE-2026-24036 Horilla Exposes Unpublished Job Disclosures through Unauthenticated API

Medium 5.3 Published 22 Jan 2026 Updated 22 Jan 2026

Unauthenticated attackers can view unpublished job details and access application workflows in Horilla HRMS, leaking sensitive internal hiring information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24036?

CVE-2026-24036 is a medium-severity missing authorization vulnerability in horilla-opensource horilla, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Horilla is a free and open source Human Resource Management System (HRMS). Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing unauthenticated users to view unpublished roles and access the application workflow for unpublished jobs. Unauthorized access to unpublished job posts can leak sensitive internal hiring information and cause confusion among candidates. This issue has been fixed in version 1.5.0.

Weakness: CWE-284

Which versions are affected by CVE-2026-24036?

It affects 1 product.

Products include Horilla Horilla.

How do I fix CVE-2026-24036?

No fix has been published for CVE-2026-24036 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24036 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24036 exists.

Sources

Also known as GHSA-q4xr-w96p-3vg7.