CVE-2026-90490
MediumCVSS 6.3Summary
A security flaw has been discovered in lenve vhr version 1.0-SNAPSHOT. Unknown processing in the MailReceiver component leads to deserialization of untrusted data. The attack can be carried out remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can exploit deserialization to execute arbitrary code on the server, potentially leading to full system compromise. The public availability of the exploit increases the likelihood of attack.
Recommendation
Update vhr to a fixed version or disable/secure the MailReceiver component. Implement safe deserialization mechanisms and restrict access to the mail service.
Other vulnerabilities in vhr
See all- CVE-2026-85214High
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
- CVE-2026-85182High
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Original NVD description (English source)
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.