CVE-2026-86066: Horilla attendance approval endpoint is vulnerable to cross-site request forgery
Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.changeattendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horillato a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Who can be targeted by this issue?
A logged-in manager who has the attendance.change_attendance permission can be targeted. The resulting approval is performed with that manager's privileges and recorded as if the manager approved it.
What does an attacker need to exploit it?
The attacker does not need to authenticate to Horilla. They need to cause an eligible logged-in manager to make a top-level request to the affected endpoint, allowing the manager's SameSite=Lax session cookie to be sent.
Are installations running the fixed release affected?
No. The issue affects Horilla versions before 2.0.0 and is fixed in version 2.0.0.