EUVD-2026-76974
GHSA-rx99-9qgv-2g6h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege vhr account
-
DeliveryCraft updateHr request with injected role/privilege fields
-
ExploitSubmit to HrInfoController.updateHr endpoint
-
ExecutionMyBatis mapper applies unsanitized parameters
-
PersistAttacker account elevated to administrator
-
ImpactFull HR system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires a valid, authenticated session with at least low-privilege access to the vhr application (PR:L per CVSS 4.0 vector). The attacker must be able to reach the HrInfoController.updateHr HTTP endpoint over the network. No special non-default configuration is required - the flaw exists in the default application logic. Limiting factors: the attacker must hold a legitimate vhr account; the application must be network-accessible; and the product's educational/demo nature means production deployments are scarce. No user interaction by a privileged user is required once the attacker has their own credentials. |
| Impact | The official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) significantly understates the real-world integrity impact of privilege escalation: a low-privilege user gaining administrative access in an HR system represents a high integrity impact, not low. The CVSS 4.0 vector correctly identifies PR:L (authenticated, low privilege required) and AV:N (network exploitable), but the impact metrics appear miscalibrated for a privesc scenario. No CISA KEV listing exists, meaning no confirmed active exploitation at time of analysis, but a public proof-of-concept is confirmed per the advisory at github.com/ArrestX/vhr-advisories (VHR-VULN-001-mass-assignment-privesc). EPSS data is not provided in the input; given the obscurity of the product, broad exploitation is unlikely but targeted abuse against deployed instances is plausible given POC availability. The practical risk is bounded by the rarity of production deployments - vhr is primarily an educational/demo project - but any organization running it in production should treat this as a high-integrity-impact finding. |
| Exploit ScenarioDerived | An authenticated low-privilege HR system user crafts an HTTP request to the updateHr endpoint, supplying their normal password update parameters alongside injected fields such as role=ADMIN or enabled=true. The MyBatis HrMapper.xml UPDATE statement, lacking field-level filtering, applies all supplied parameters to the database row. The attacker's account is silently elevated to administrator, granting full system access. A public proof-of-concept demonstrating this exact technique has been disclosed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 13, 2026
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor did not respond to disclosure. As a compensating control, operators should restrict access to the updateHr endpoint (e.g., via API gateway or Spring Security authorization rules) so that only administrators can invoke it, preventing low-privilege users from reaching the vulnerable code path - trade-off: this may break legitimate self-service HR update flows. Alternatively, developers can fix the root cause by explicitly whitelisting only safe fields (e.g., password, phone, address) in the updateHr service layer and rejecting or ignoring any role/privilege/enabled fields in the incoming payload - this is the correct long-term fix with no functional trade-off. Given the vendor non-response, organizations relying on this software should consider replacing it or forking and applying the fix directly. The researcher advisory at https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-001-mass-assignment-privesc.md should be consulted for specific payload details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vhr (Vue HR) is an open-source, educational HR management system authored by lenve, built on a Vue.js frontend with a Spring Boot backend and MyBatis ORM (evidenced by HrMapper.xml, a MyBatis SQL mapper file). The vulnerable endpoint HrInfoController.updateHr processes HTTP requests to update user HR records. The root cause is a mass-assignment flaw (categorized as CWE-266, Incorrect Privilege Assignment): the updateHr method likely binds the full incoming HTTP request body or parameter map directly to the HrMapper UPDATE statement without filtering out security-sensitive fields such as role, enabled, or adminStatus. By injecting these fields alongside the legitimate Password parameter, an authenticated low-privilege user can set their own privilege level to administrator. This is a classic Spring MVC / MyBatis mass-assignment pattern where the ORM mapper update statement exposes all mapped columns.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible endpoint requiring authenticated low-privilege user; privilege escalation yields high integrity impact; no confidentiality or availability impact beyond lateral access.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB