Auth bypass in Horilla-opensource Horilla

CVE-2026-40867

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing t…

EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.