CVE-2026-85182
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Risk Assessment
The risk includes unauthorized password changes for other users, potentially leading to account takeover, privilege escalation, and data confidentiality breach.
Recommendation
It is recommended to immediately upgrade vhr to a patched version and implement ownership verification in the PUT /hr/pass endpoint.
Other vulnerabilities in vhr
See all- CVE-2026-90490Medium
A security flaw has been discovered in lenve vhr version 1.0-SNAPSHOT. Unknown processing in the MailReceiver component leads to deserialization of untrusted data. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-85214High
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Original NVD description (English source)
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.