CVE-2026-40866: Horilla: Unauthorized Document Overwrite via File Upload Endpoint

Published Apr 21, 2026

Updated

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

Affected Software

1 affected component

Horilla Horilla HRMS=1.5.0

Event History

Apr 21, 2026

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-40866?

CVE-2026-40866 is rated as a critical severity vulnerability due to its potential impact on data integrity and confidentiality.

How do I fix CVE-2026-40866?

To fix CVE-2026-40866, ensure proper authorization checks are implemented on the document upload endpoint in Horilla HRMS version 1.5.0.

Who is affected by CVE-2026-40866?

CVE-2026-40866 affects users of Horilla HRMS version 1.5.0 who have access to the employee document upload feature.

What is the exploit method for CVE-2026-40866?

The exploit method for CVE-2026-40866 involves using an insecure direct object reference in the document upload endpoint to overwrite files.

Is there a patch available for CVE-2026-40866?

Yes, there is a patch available in newer versions of Horilla HRMS that addresses the vulnerability.