The exploit allows an authenticated user to change identifiers in payroll component views to retrieve the salary structure, allowances, deductions, personal loan disbursements, and repayment schedules of other employees. This is an Insecure Direct Object Reference (IDOR) that bypasses authorization checks before loading data, exposing highly confidential employee information. The weakness is a missing authorization check, corresponding to CWE‑862.

The vulnerable product is Horilla HR, version 1.5.0‑85 or earlier. No patched release is currently available, so all installations with these or earlier versions remain at risk.

With a CVSS score of 6.5 the vulnerability is considered moderate. The EPSS score is not available, and the issue is not listed in CISA KEV. The likely attack vector is through authenticated users who have any valid login to the system; by simply modifying emp_id, allowance_id, or deduction_id in the URL or form inputs they can obtain records they should not be able to access. Attack preparation requires only knowledge of existing identifiers, so exploitation is straightforward if the system remains unpatched.