---
id: CVE-2026-86066
title: Horilla is an HR and CRM software
summary: >-
  Horilla is an HR and CRM software. Prior to 2.0.0,
  approve_validate_attendance_request at
  /attendance/approve-validate-attendance-request/ changes attendance_validated,
  is_validate_request_approved, approved_by, and related pending-reque…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-352
vendor: horilla
product: horilla-hr
affected:
  - horilla-hr < 2.0.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:16:54.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86066'
references:
  - url: >-
      https://github.com/horilla/horilla-hr/commit/87a23ecaf2944c15dc5c131f813d2b83fd56eaa0
    label: security-advisories@github.com
  - url: 'https://github.com/horilla/horilla-hr/releases/tag/2.0.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/horilla/horilla-hr/security/advisories/GHSA-65vj-5p5g-pv5m
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-25T23:21:16.955Z'
---

## Overview

Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.