Lenve vhr EUVD-2026-99258

Requires an authenticated operator account of any privilege level (CVSS PR:L) that can reach the application's HTTP interface; exploitation is then a single GET /chat/hrs call. The root cause is that the ChatController returns the full serialized Hr entity, and the HrMapper SQL/entity (Hr.java) exposes the password field, so the BCrypt hash plus phone number and address of every operator are returned without field filtering. Limiting factors: valid low-privileged credentials are mandatory (not remote-unauthenticated), the disclosed passwords are BCrypt-hashed rather than plaintext so actual privilege escalation requires successful offline cracking of weak passwords, and impact is confined to confidentiality (no data modification or service disruption).

This is a genuine but moderate-priority issue, best understood as a trustworthy-but-limited CVSS-7.1 finding rather than an urgent fire. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privileged operator account, and yields high confidentiality impact (password hashes, phone numbers, addresses) with no integrity or availability impact. The real-world escalation is not immediate - the leaked credentials are BCrypt hashes, which are deliberately slow to crack, so VC:H reflects disclosure of sensitive data but the privilege-escalation outcome depends on successful offline cracking (weak admin passwords). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept exploit flag was set, so exploitation status is: no public exploit identified at time of analysis - although detailed technical write-ups (hackmd, VulnCheck advisory) exist that would make reproduction straightforward. Net: credible, low-complexity data exposure gated behind authentication, but mitigated by the hashed (not plaintext) nature of the secrets and the absence of any active-exploitation or widespread-deployment signal.

A low-privileged operator who already has a valid account logs in and issues a single GET /chat/hrs request, receiving the fully serialized Hr entity for every other operator - including administrators' BCrypt password hashes, phone numbers, and addresses. The attacker exfiltrates the admin hashes and runs them through an offline cracker; if any administrator used a weak password, they recover the plaintext and escalate to full administrative control. No public exploit code is identified, but the low attack complexity (AC:L) and public technical write-ups make reproduction trivial for any authenticated user.