Read the docs
TI-2026-58876 Aliases CVE-2026-86066

Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Priority MEDIUM 62CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed horilla-hr (horilla): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
horilla-opensourcehorilla-hrbefore 2.0.02.0.0Patch availableCNA
  • horilla-hr Vendorhorilla-opensource Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

Remediation

  • Fix · CNA horilla-hr (horilla) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86066

References

Other 3

  • TI-2025-37271 Horrila Stored XSS Vulnerability via Ticket Comment section CVSS 3.1CRITICAL 9.9
  • TI-2026-63868 Horilla: Authenticated RCE in Horilla List-View Export CVSS 3.1HIGH 8.8
  • TI-2026-50095 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View CVSS 4.0HIGH 8.5
  • TI-2026-29522 Horilla: Unauthorized Document Overwrite via File Upload Endpoint CVSS 4.0HIGH 8.6
  • TI-2025-31025 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control CVSS 3.1HIGH 7.5
  • TI-2026-29521 Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> CVSS 4.0HIGH 7.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences