The vulnerability is an insecure direct object reference in the employee document upload endpoint of the Horilla HRMS version 1.5.0. Any authenticated user can modify the document ID in the upload request and overwrite, replace, or corrupt another employee’s file, enabling unauthorized changes to HR records. This flaw violates integrity and is an instance of broken access control (CWE‑284) and an authorization bypass (CWE‑639).

Affects the Horilla open‑source Human Resource Management System, specifically version 1.5.0. No other versions are listed in the advisory.

With a CVSS score of 8.6 the vulnerability presents high severity. While the EPSS score is not available and the flaw is not listed in KEV, the lack of these metrics does not diminish the threat. An attacker must first be authenticated and possess upload privileges, then can alter the destination document ID to target any employee, resulting in tampering of personnel records and potential compromise of confidentiality, integrity, and contractual obligations. Immediate remediation is recommended to prevent unauthorized document manipulation.