An insecure direct object reference in Horilla’s employee document viewer allows any authenticated user to change a numeric document identifier in the URL and obtain access to other employees’ confidential files, including identity documents, contracts, and certificates. This weakness is aligned with CWE-284, illustrating erroneous permission assignment, and CWE-639, reflecting authorization bypass through user‑controlled input. The exposed data could lead to identity theft, privacy violations, and compromise of sensitive corporate records if accessed by malicious actors.

The affected product is the open‑source Human Resource Management System Horilla, version 1.5.0. Users running this exact version of the software are vulnerable; all newer releases that have applied the fix are not affected.

The CVSS score of 7.1 indicates a moderate to high severity. Because the vulnerability requires authentication, an attacker must possess valid user credentials or gain access through other means before exploitation can occur. Current EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, any organization that stores sensitive employee records should consider the risk of internal misuse or credential compromise.