CVE-2026-63432 horilla CVE debrief

Who should care

Defenders responsible for Horilla HR and CRM software installations, administrators, and security teams should assess exposure and apply patches or updates to prevent potential exploitation.

Why it matters

CVE-2026-63432 is an information disclosure vulnerability in Horilla HR and CRM software that allows authenticated users to access sensitive data. Defenders should prioritize verifying exposure and applying patches to prevent potential exploitation.

• Authenticated users can access sensitive information, including password hashes and server request metadata.
• Possible offline password cracking or account compromise may occur if password hashes are obtained.
• Defenders should verify exposure and apply patches or updates to prevent potential exploitation.
• Monitoring for potential exploitation attempts and reviewing server logs for suspicious activity is recommended.

Technical summary

The get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, as this vulnerability allows authenticated users to access sensitive information.

Recommended defensive actions

• Verify exposure by checking if the installed version of Horilla HR and CRM software is within the affected range (1.0.0 through 1.6.0 and 2.0.0).
• Apply patches or updates to versions 1.6.0 or 2.0.0, which are reported to fix the issue.
• Monitor for potential exploitation attempts and review server logs for suspicious activity.
• Consider implementing additional security measures, such as restricting access to sensitive data and enforcing strong password policies.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is fixed in versions 1.6.0 and 2.0.0. There is no information on known or unknown affected scope beyond the specified versions. Defenders should verify exposure by checking the installed version of Horilla HR and CRM software and apply patches or updates to prevent potential exploitation. The CVE record does not provide explicit evidence of exploitation or additional details on the nature

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.