EUVD-2026-70492
GHSA-w3q5-4jvr-jm6p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint (AV:N), no complexity (AC:L), requires only a valid user session (PR:L), no user interaction, no scope change; integrity and availability both high due to arbitrary profile overwrite and admin lockout; no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in vhr with any privilege level (PR:L); there are no further role restrictions on the PUT /hr/info endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) accurately reflects the attack posture: network-reachable, low complexity, requiring only a valid session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production instances of vhr in your environment, implement network-level access restrictions to the PUT /hr/info endpoint if feasible, and audit recent modification logs for suspicious changes to administrator or HR profiles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privi
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who kno
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote a
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today