EUVD-2026-24601Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.
AnalysisAI
Missing authorization in a+HRD API allows authenticated low-privilege remote attackers to read arbitrary database contents. The vulnerability exists in a specific API method that fails to properly verify user permissions, enabling lateral privilege escalation to access sensitive data beyond the attacker's authorization scope. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with network attack vector and low attack complexity, though exploitation requires valid user credentials.
Technical ContextAI
a+HRD is a human resources management system developed by aEnrich. This vulnerability is classified as CWE-862 (Missing Authorization), where the application fails to perform authorization checks on the server side. The API endpoint accepts authenticated requests but does not validate whether the requesting user has appropriate permissions to access the requested database resources. The CVSS vector indicates network-accessible (AV:N) exploitation with low complexity (AC:L) requiring low privileges (PR:L), meaning any authenticated user can exploit this without requiring elevated permissions. The CPE identifier cpe:2.3:a:aenrich:a+hrd:*:*:*:*:*:*:*:* indicates all versions are potentially affected, though the advisory does not specify exact version ranges.
RemediationAI
Consult the Taiwan CERT advisory at https://www.twcert.org.tw/en/cp-139-10834-eb3ee-2.html and contact aEnrich directly for patch availability and specific remediation guidance, as no fix version is confirmed in available intelligence. Until a vendor patch is applied, implement the following compensating controls: Enforce network segmentation to restrict access to a+HRD API endpoints only from trusted internal networks or VPN connections, reducing exposure of the vulnerable API method. Deploy database activity monitoring to detect and alert on abnormal query patterns or access to sensitive tables by low-privilege application accounts. Review and minimize user account privileges within a+HRD to ensure the principle of least privilege, reducing the number of accounts that could exploit this vulnerability. Implement web application firewall rules to inspect and restrict API requests to the specific vulnerable endpoint if it can be identified. Note that these controls reduce but do not eliminate risk, and credential theft or insider threats can still enable exploitation.
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. Rated cri
aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to uplo
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability th
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user inpu
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. Rated high severity (C
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Ac
aEnrich a+HRD has inadequate filtering for special characters in URLs. Rated high severity (CVSS 7.5), this vulnerabilit
SQL injection in aEnrich a+HRD allows authenticated remote attackers to read database contents through malicious SQL com
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restriction
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to c
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to s
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today