CVE-2026-86066

Received Received - Intake

CSRF Bypass in Horilla HR CRM via GET Request

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-86066

Affected Vendors & Products

Vendor	Product	Version / Range
horilla	hr_and_crm_software	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Horilla HR and CRM software versions prior to 2.0.0. It involves an attendance approval function that uses an HTTP GET request without CSRF validation. An unauthenticated attacker can trick a logged-in manager into making a request that silently approves attendance changes using the manager's session, falsely attributing the approval to the victim in audit logs.

Impact Analysis

An attacker could exploit this to manipulate attendance records without authorization, potentially leading to incorrect payroll, compliance violations, or fraudulent activity. Managers' accounts may be falsely implicated in unauthorized approvals, creating audit trail discrepancies.

Compliance Impact

This vulnerability could lead to unauthorized changes in attendance records, potentially violating data integrity requirements under GDPR and HIPAA. Incorrect records may result in non-compliance with audit and accountability controls.

Mitigation Strategies

Upgrade Horilla to version 2.0.0 or later to fix the vulnerability. Ensure no unauthenticated requests are allowed for attendance approval actions.

Hi! I’m here to help you understand CVE-2026-86066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70