Vulnerability Description
Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.
Related Weaknesses (CWE)
References
- https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46
- https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw
- https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw
FAQ
What is CVE-2026-41513?
CVE-2026-41513 is a documented vulnerability. Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted appl...
How severe is CVE-2026-41513?
CVSS scoring is not yet available for CVE-2026-41513. Check NVD for updates.
Is there a patch for CVE-2026-41513?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.