Information disclosure in horilla-opensource horilla-hr
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-94.
Summary
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| horilla-opensource | horilla-hr | 1.0.0 to before 1.6.0; 2.0.0-beta.1 to before 2.0.0 | 1.6.0, 2.0.0 | Patch available | CNA |
- horilla-hr Vendorhorilla-opensource Affected 1.0.0 to before 1.6.0; 2.0.0-beta.1 to before 2.0.0 Fixed in 1.6.0, 2.0.0 Patch available CNA
Remediation
- Fix · CNA horilla-hr (horilla) Fixed in 1.6.0, 2.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63432
References
Other 4
- https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24
- https://github.com/horilla/horilla-hr/commit/bd3eed2168b0167f273a8dd7f218f1b37320ac39
- https://github.com/horilla/horilla-hr/commit/f1ca7cbc6216cb5bf19fc0174f49994ce5ffc2ad
- https://github.com/horilla/horilla-hr/releases/tag/2.0.0
More horilla-opensource vulnerabilities
- TI-2025-37271 Horrila Stored XSS Vulnerability via Ticket Comment section CVSS 3.1CRITICAL 9.9
- TI-2026-63868 Horilla: Authenticated RCE in Horilla List-View Export CVSS 3.1HIGH 8.8
- TI-2026-50095 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View CVSS 4.0HIGH 8.5
- TI-2026-29522 Horilla: Unauthorized Document Overwrite via File Upload Endpoint CVSS 4.0HIGH 8.6
- TI-2025-31025 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVSS 3.1HIGH 7.5
- TI-2026-29521 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> CVSS 4.0HIGH 7.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences