CVE-2026-63431: Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Horilla employee account may be able to exploit it. The account does not need to own the targeted payroll record or have payroll-view permissions.
What does exploitation require?
An attacker needs a valid authenticated account and must modify employee, allowance, or deduction identifiers used by the affected views. No user interaction from the victim is required.
What information could be exposed?
Unauthorized users may read other employees' salary structures, allowance and deduction amounts, personal loan disbursements, and repayment schedules.
Are installations affected by default?
The affected component views do not consistently enforce authorization before loading records. Deployments running Horilla 1.5.0-85 or earlier should treat authenticated employee access to these views as potentially exposed.
What can be done if a complete fix is not available?
Restrict access to the affected payroll component views to only trusted users, and review authenticated access for attempts to request records using identifiers belonging to other employees. A complete fixed version was not available as of the review.