Is CVE-2026-86066 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86066 being exploited in the wild.

How severe is CVE-2026-86066?

Informational severity, published 25 September 2026.

Is there a fix for CVE-2026-86066?

A patch was published on 2026-08-30: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86066 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86066?

Check whether you run Horilla HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86066: Horilla CSRF in attendance approval

CVE-2026-86066 · Severity: info · Published 2026-09-25

Horilla is HR and CRM software that manages employee records, scheduling, and approval workflows. A flaw in the attendance approval system allows an unauthenticated attacker to trick a logged-in manager into silently approving attendance records without their knowledge, with the approval falsely attributed to the manager in audit logs. An attacker could exploit this to manipulate attendance records and hide the actual approver's identity.

Vendors: Horilla.

Quick answers

Is CVE-2026-86066 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86066 being exploited in the wild.
How severe is CVE-2026-86066?: Informational severity, published 25 September 2026.
Which products and versions are affected?: Horilla HR before 2.0.0.
Is there a fix for CVE-2026-86066?: A patch was published on 2026-08-30: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86066 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86066?: Check whether you run Horilla HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The approve_validate_attendance_request endpoint at /attendance/approve-validate-attendance-request/ modifies attendance records via HTTP GET request without CSRF validation, as the changes occur before calling attendance.save(). An unauthenticated attacker can craft a top-level request that carries a manager's SameSite=Lax session cookie to perform state changes (attendance_validated, is_validate_request_approved, approved_by). The vulnerability requires the victim to be logged in and hold attendance.change_attendance permissions, but no user interaction is needed beyond visiting an attacker-controlled page.

Affected products

Horilla Horilla HR before 2.0.0

Timeline

2026-09-25: disclosed
2026-08-30: patched: Fixed in version 2.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.