EUVD-2026-76971
GHSA-g3rg-5f38-q7q5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required authentication; I:H reflects arbitrary account takeover via password replacement; no confidentiality or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any arbitrary employee record by supplying a manipulated hrid parameter to the /hr/pass endpoint, enabling horizontal privilege escalation and account takeover across the HR application. The flaw in HrInfoController.updatePass accepts the target employee identifier from client input without verifying that the requesting session holds rights over that specific record - a classic IDOR pattern classified under CWE-285. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated session with at least low-privilege access to the lenve vhr application (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3, placing this in the Medium band, with the E:P exploit-maturity modifier acknowledging that public exploit code exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privi
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who kno
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to ove
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote a
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through
Same weakness CWE-285 – Improper Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today