Horilla HR software contains an improper access control flaw that allows any authenticated employee to upload documents on behalf of another employee. The vulnerability stems from insufficient server‑side validation of the employee_id parameter during file upload, enabling the attacker to place files in the context of other users. This can compromise confidentiality and integrity of employee records and provide a vector for data leakage or malicious file distribution.

The affected product is Horilla – the open‑source HRMS provided by horilla‑opensource. Versions starting at 1.4.0 and up to, but not including, 1.5.0 are vulnerable. Version 1.5.0 includes the fix and is considered safe.

The CVSS score of 4.3 indicates moderate severity; exploitation requires only authentication of a legitimate HRMS user, so an insider or compromised account can easily abuse the issue. The EPSS score is below 1 %, suggesting low overall likelihood of public exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, once an authenticated user can upload a file as another employee, they could inject malicious content or falsify records, making mitigation a priority. The attack vector is inferred to be the web interface or API where file uploads occur, and the vulnerability does not provide remote code execution.