CSRF Vulnerability in Horilla HR and CRM Software
CVE-2026-86066

5.9MEDIUM

Key Information:

Vendor

Horilla

Status
Horilla-hr
Vendor
CVE Published:
25 September 2026

What is CVE-2026-86066?

In Horilla HR and CRM software, prior to version 2.0.0, a CSRF vulnerability exists in the approve_validate_attendance_request function. This vulnerability allows an unauthenticated attacker to exploit the session of a logged-in manager. By making a top-level request carrying the manager's SameSite=Lax session cookie, an attacker can silently approve an attendance request using the manager’s permissions. The effective approval would be attributed to the victim in the audit trail, leading to potential misuse of authority without any CSRF validation safeguards. This issue has been resolved in version 2.0.0.

Affected Version(s)

horilla-hr < 2.0.0

References

https://github.com/horilla/horilla-hr/security/advisories...
x_refsource_CONFIRM
https://github.com/horilla/horilla-hr/commit/87a23ecaf294...
x_refsource_MISC
https://github.com/horilla/horilla-hr/releases/tag/2.0.0
x_refsource_MISC

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.