CVE-2026-110217
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Risk Assessment
The risk includes the possibility of cracking administrator passwords and privilege escalation, potentially leading to full system compromise and data confidentiality breach.
Recommendation
It is recommended to immediately restrict access to the /chat/hrs endpoint and enforce strong passwords and additional authentication mechanisms.
Other vulnerabilities in Lenve vhr
See all- CVE-2026-90501Medium
A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-90500Medium
A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2026-90499Medium
A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.
- CVE-2026-90498High
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.
Original NVD description (English source)
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS