CVE-2026-40865 Details

A vulnerability allowing unauthorized access to employee documents has been identified in Horilla HRMS version 1.5.0. This insecure direct object reference (IDOR) issue allows any authenticated user to view other employees' uploaded files by simply changing the document ID in the request. The flaw exposes sensitive HR materials, including identity documents, contracts, certificates, and other private employee records. The vulnerability arises because the document viewer endpoint retrieves files based solely on their numeric IDs, without verifying if the requesting user has the right to access them.