{"id":"CVE-2026-63431","revision":"98bc8fdd9bc6493fbaf0b2e6d4f71aea","records":[{"revision":"98bc8fdd9bc6493fbaf0b2e6d4f71aea","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63431","aliases":[],"title":"Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)","description":"Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review.","state":0,"publishedAt":"2026-09-25T21:56:00.074+00:00","modifiedAt":"2026-09-30T00:11:12.578+00:00","affected":[{"ecosystem":"Vendor product","name":"horilla-hr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"horilla\",\n                    \"product\": \"horilla-hr\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 1.5.0-85\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/horilla/horilla-hr/security/advisories/GHSA-c38j-fg3w-7rph","https://github.com/horilla/horilla-hr/commit/a17fdbbbfe9a276560d5f82e8360ab1910e623bf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63431","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63431","identifiers":["CVE-2026-63431"]},"retained":false,"historicalAffected":[]}],"coverage":[]}