CVE-2026-85214
vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 3, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 3, 2026
Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
vhrlenve |
|
References
- GitHub Issue #349issue-tracking
- https://github.com/lenve/vhrproduct
- HrInfoController.java at 03abbd3technical-description
- HrMapper.xml at 03abbd3technical-description
- VulnCheck Advisory: vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwritethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.