This vulnerability is a cross‑site request forgery that allows an unauthenticated attacker to cause a logged‑in manager with attendance.change_attendance permission to unintentionally approve an attendance record. The approve_validate_attendance_request handler processes the approval via an HTTP GET request before invoking attendance.save(), bypassing Django’s CSRF validation. As a result, an attacker can trigger the endpoint with the victim’s session cookie, causing the manager to approve attendance silently and having the approval attributed to the victim in the audit trail.

The affected product is Horilla HR (horilla:horilla-hr). The issue exists in all releases prior to version 2.0.0. The vulnerability is addressed in version 2.0.0 and later.

The CVSS score of 5.9 classifies the vulnerability as moderate. EPSS data is unavailable, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalogue. The attack vector is inferred to be web‑based CSRF: an attacker can craft a link or embed a request in a third‑party site to trigger a GET request to /attendance/approve-validate-attendance-request/, and because the session cookie is sent under the SameSite=Lax policy, the victim’s browser will submit the request, leading to unauthorized attendance approval.