Horilla, an HR and CRM platform, allows an attacker to manipulate the unvalidated next query parameter in its notification endpoints. The flaw enables an arbitrary external URL to be redirected to from within the application, allowing the attacker to transform trusted links into phishing or social‑engineering attacks. The vulnerability directly compromises user trust and could facilitate credential theft or malware delivery if users navigate to malicious sites.

The affected product is Horilla HR (horilla:horilla-hr), version 1.5.0. No other versions are explicitly listed as impacted in the available data.

The CVSS score is 4.8, indicating a moderate severity when combined with limited exploitation controls. EPSS is not available, and the flaw is not listed in CISA KEV, suggesting no publicly known widespread exploitation yet. The likely attack vector is through a web request that includes a crafted next parameter, which the application trusts and redirects users without validation. An attacker can embed a malicious link that, when visited by a user, will redirect to the attacker controlled domain, enabling phishing or social‑engineering scenarios.