EUVD-2026-70486
GHSA-q54m-q6wq-qhwg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authentication (PR:L) and knowledge of target's current password (AC:H); full CIA impact on the compromised account when conditions are met.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
AnalysisAI
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who knows a target account's current password to change that account's password - a classic IDOR via CWE-639. The server accepts an arbitrary account ID in the request body without verifying it matches the session owner, enabling cross-account credential takeover by low-privileged insiders. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be satisfied: (1) the attacker holds a valid authenticated session (PR:L - any enrolled vhr user account), and (2) the attacker knows the target account's current password (AT:P - required by the API design, which demands the existing password as a confirmation field). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N; score 7.7) accurately captures the key constraints: the attacker must hold a valid session (PR:L) and must already possess the target account's current password (AT:P), making this non-trivial to automate - SSVC confirms Automatable: no. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an immediate audit of vhr deployment scope (on-premises vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privi
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to ove
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote a
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through
Share
External POC / Exploit Code
Leaving vuln.today