Horilla 1.5.0 contains a broken access control flaw in the helpdesk attachment viewer that allows any authenticated user to change the attachment ID and view attachments belonging to other tickets. The vulnerability, identified as CWE-284 and CWE-639, can expose confidential support files and internal documents, thereby compromising confidentiality and potentially allowing further exploitation if sensitive data is accessed.

The issue affects the open-source Horilla HRMS, specifically version 1.5.0. Users running this version should be aware that any authenticated account can abuse this flaw to download attachments from unrelated users or teams.

With a CVSS score of 7.1 the vulnerability is of moderate to high severity. No EPSS score is available, but the vulnerability requires authentication and is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. The attack vector is likely internal or restricted to organizations with Horilla installed; however, once login credentials are obtained or the system is compromised, an attacker can leverage the flaw to exfiltrate sensitive documents.