CVE-2026-90499
MediumCVSS 5.4Summary
A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.
Risk Assessment
An attacker could change another user's password without proper authorization, potentially leading to account takeover. This could result in unauthorized access to HR data and administrative functions.
Recommendation
Restrict access to the /hr/pass endpoint and apply a patch as soon as it becomes available. Monitor logs for unexpected password changes.
Other vulnerabilities in lenve vhr
See all- CVE-2026-90501Medium
A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-90500Medium
A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2026-90498High
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.
Original NVD description (English source)
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.