vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

Versions reported by the vendor

Affected version ranges reported by the assigning authority (VulnCheck). Independent of NVD's CPE analysis and usually ahead of it.

• lenve vhr

  • up to and including 03abbd35af24e55368ce4e09f4038dc2aba3ff5faffected · git

Other highest-scoring records for the same primary product.

• CVE-2026-110217vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
  28Monitor
• CVE-2026-85214vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
  28Monitor
• CVE-2026-90498lenve vhr vhr.sql default credentials
  22Monitor

Published before and after this one in the same product

• Later →CVE-2026-90490Sep 12, 2026 · lenve vhr MailReceiver deserialization
  8Monitor
• Later →CVE-2026-90499Sep 13, 2026 · lenve vhr Password Update pass HrInfoController.updatePass improper authorization
  8Monitor
• Later →CVE-2026-90500Sep 13, 2026 · lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
  8Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.