Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63431— Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Quick assessment

Affected
horilla horilla-hr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Horilla 是一款人力资源（HR）和客户关系管理（CRM）软件。在版本 1.5.0-85 及更早版本中， 文件中的 、 和 函数在根据 、 或 加载相应记录之前，未能一致地执行访问授权控制。因此，已认证的员工可以通过替换这些标识符，在自身不拥有相关记录且不具备 payroll-view（工资查看）权限的情况下，读取其他员工的薪酬结构、津贴与扣款金额、个人贷款发放记录及还款计划。截至本报告审查时，尚未提供完整的修复版本。

CVSS 6.5 · Medium EPSS 0.21% · P11

Affected Version Matrix 1

VendorProduct Version RangeStatus
horilla horilla-hr <= 1.5.0-85 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63431

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)
Source: CVE Program / CVE List V5
Vulnerability Description
Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
horilla horilla-hr <= 1.5.0-85 -

II. Public POCs for CVE-2026-63431

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63431

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63431 (1)

Vendor Advisories for CVE-2026-63431 (1)

Same Patch Batch · horilla · 2026-09-25 · 5 CVEs total

CVE-2026-96795 8.8 HIGH Horilla: Authenticated RCE in Horilla List-View Export
CVE-2026-71483 8.5 HIGH Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
CVE-2026-63432 6.5 MEDIUM Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authentica
CVE-2026-86066 5.9 MEDIUM Horilla attendance approval endpoint is vulnerable to cross-site request forgery

IV. Related Vulnerabilities

Same product: horilla-hr
Same vendor: horilla
Same weakness: CWE-862

V. Comments for CVE-2026-63431

No comments yet

Leave a comment