CVE-2026-86066 horilla CVE debrief

Who should care

Defenders responsible for Horilla HR and CRM software installations, particularly those with attendance management functionality, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-86066 is a medium-severity vulnerability in Horilla HR and CRM software that allows an unauthenticated attacker to silently approve attendance requests with a logged-in manager's privileges. Defenders responsible for Horilla installations should assess exposure, prioritize verification and remediation, and consider restricting access to attendance approval functionality.

• Potential unauthorized attendance approval with victim's privileges
• Silent approval of attendance requests without user's knowledge
• Attribution of approval to victim in audit trail
• Verification of version upgrade to 2.0.0 required

Technical summary

The approve_validate_attendance_request function at /attendance/approve-validate-attendance-request/ in Horilla HR and CRM software prior to version 2.0.0 allows an unauthenticated attacker to change attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET request before calling attendance.save(). This issue enables silent approval of attendance requests with a logged-in manager's privileges, attributing the approval to the victim in the audit trail. Defenders should prioritize verifying and upgrading to version 2.0.0 to prevent unauthorized attendance approval.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.0.0 of Horilla HR and CRM software to prevent unauthorized attendance approval.

Recommended defensive actions

• Verify and upgrade to version 2.0.0 of Horilla HR and CRM software
• Restrict access to attendance approval functionality
• Monitor for suspicious attendance approval requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is fixed in version 2.0.0 of Horilla HR and CRM software. Defenders should verify the version and consider restricting access to attendance approval functionality. The CVE Program record (cve-org) and NVD detail page (nvd) offer official source-provided CVE metadata and vulnerability assessment. Additional source references (ref-3, ref-4, ref-5) provide further context on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.