Improper Access Control in Horilla HR Software Affects User Document Uploads
CVE-2026-24035

4.3MEDIUM

Key Information:

Vendor: Horilla-opensource
Status: Horilla
Vendor: CVE Published:; 22 January 2026

🔔 Create Horilla-opensource Vulnerability Alert

What is CVE-2026-24035?

The Horilla HR Software contains an improper access control vulnerability that affects versions from 1.4.0 and earlier. This flaw allows authenticated users to upload documents for other employees without authorization due to inadequate server-side validation of the employee_id parameter during file upload actions. The lack of proper validation can lead to unauthorized data manipulation and compromise the integrity of employee documents. This issue has been resolved in version 1.5.0, which addresses the inadequate checks present in earlier versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch