CVE-2026-86066

Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_validated, is_validate_request_approved, approved_by, and related pending-request state through an HTTP GET before calling attendance.save(), so Django does not require CSRF validation for the action. An unauthenticated attacker can cause a logged-in manager with attendance.change_attendance to make a top-level request that carries the manager's SameSite=Lax session cookie, silently approving attendance with the victim's privileges and attributing the approval to the victim in the audit trail. This issue is fixed in version 2.0.0.

• CWE-352

• https://github.com/horilla/horilla-hr/commit/87a23ecaf2944c15dc5c131f813d2b83fd56eaa0
• https://github.com/horilla/horilla-hr/releases/tag/2.0.0
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-65vj-5p5g-pv5m
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-65vj-5p5g-pv5m

Published

Sep 25, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-86062LightRAG provides simple and fast retrieval-augmented genera…6.1
• CVE-2026-86063Claude Code is an agentic coding tool. Prior to 2.1.179, the…7.5
• CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-86065Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86071Junrar is an open source Java RAR archive library. Prior to …3.7
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6
• CVE-2026-86074n8n is an open source workflow automation platform. Prior to…7.1
• CVE-2026-86075n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-86076n8n is an open source workflow automation platform. Prior to…8.8