CVE-2026-85214
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Risk Assessment
An attacker can modify other users' personal data and disable accounts, potentially leading to data integrity compromise and denial of service.
Recommendation
Apply a patch that adds authorization validation to the PUT /hr/info endpoint. Restrict access to this endpoint and monitor logs for unauthorized changes.
Other vulnerabilities in vhr
See all- CVE-2026-90490Medium
A security flaw has been discovered in lenve vhr version 1.0-SNAPSHOT. Unknown processing in the MailReceiver component leads to deserialization of untrusted data. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-85182High
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Original NVD description (English source)
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.