Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86066— Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Quick assessment

Affected
horilla horilla-hr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Horilla 是一款人力资源（HR）和客户关系管理（CRM）软件。在版本 2.0.0 之前，端点 上的 函数通过 HTTP GET 请求修改了 、 、 以及相关待处理请求的状态，之后才调用 。由于该操作通过 GET 请求完成，Django 框架不会对其执行 CSRF（跨站请求伪造）验证。 未认证的攻击者可以诱导已登录且具有 权限的管理员发起一个顶级请求，该请求会携带管理员的 会话 Cookie，从而在受害者不知情的情况下，使用受害者的权限批准考勤记录，并将批准行为归于受害者，从而在审计日志中留下虚假记录。该问题已

CVSS 5.9 · Medium EPSS 0.20% · P9

Affected Version Matrix 1

VendorProduct Version RangeStatus
horilla horilla-hr < 2.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86066

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Horilla attendance approval endpoint is vulnerable to cross-site request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
horilla horilla-hr < 2.0.0 -

II. Public POCs for CVE-2026-86066

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86066

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86066 (1)

Vendor Pages for CVE-2026-86066 (1)

Same Patch Batch · horilla · 2026-09-25 · 5 CVEs total

CVE-2026-96795 8.8 HIGH Horilla: Authenticated RCE in Horilla List-View Export
CVE-2026-71483 8.5 HIGH Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
CVE-2026-63431 6.5 MEDIUM Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structur
CVE-2026-63432 6.5 MEDIUM Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authentica

IV. Related Vulnerabilities

Same product: horilla-hr
Same vendor: horilla
Same weakness: CWE-352

V. Comments for CVE-2026-86066

No comments yet

Leave a comment