CVE-2026-86066

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0

Description An issue exists where the endpoint '/attendance/approve-validate-attendance-request/' modifies attendance validated, is validate request approved, approved by, and pending-request states via an HTTP GET request before calling the attendance.save() function. Because Django does not require Cross-Site Request Forgery (CSRF) validation for GET requests, an unauthenticated attacker can trick a logged-in manager with attendance.change attendance permissions into making a top-level request. This allows the attacker to silently approve attendance using the manager's privileges and attribute the action to the victim in the audit trail.

Recommendations Update to version 2.0.0.