CVE-2026-63431

Received Received - Intake

Unauthorized Salary Data Exposure in Horilla HR Software

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-63431

Affected Vendors & Products

Vendor	Product	Version / Range
horilla	hr_and_crm_software	to 1.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in Horilla HR and CRM software versions 1.5.0-85 and earlier. It allows an authenticated employee to access sensitive payroll data of other employees by manipulating identifiers in the system. The issue occurs because the software does not properly check permissions before displaying salary structures, allowances, deductions, loans, and repayment schedules.

Detection Guidance

Since this is a logical access control flaw in Horilla's payroll component, detection requires reviewing application logs for unauthorized access to salary structures, allowances, deductions, or loan data. Check for requests to endpoints like payroll/views/component_views.py with parameters emp_id, allowance_id, or deduction_id that return data not belonging to the requesting user.

Impact Analysis

An attacker could exploit this to view another employee's confidential payroll information, including salary details, personal loans, and repayment schedules. This could lead to privacy breaches, financial data exposure, or misuse of sensitive HR records.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if employee health-related financial data is exposed. It undermines data protection requirements for confidentiality and access controls in both regulations.

Mitigation Strategies

Immediately restrict access to payroll-related endpoints by implementing strict role-based authorization checks. Temporarily disable the affected endpoints if no fixed version is available. Monitor logs for suspicious access patterns and consider network segmentation to isolate payroll systems.

Hi! I’m here to help you understand CVE-2026-63431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70