In Hinemos, an incorrect privilege assignment in the password change API allows a non‑administrative user with specific permissions to change any user's password, including that of an administrator. This flaw effectively gives the attacker the ability to hijack an administrative account, achieving full control over the system. The weakness is identified as CWE-266 (Improper Privilege Management), underscoring the improper access control that enables this attack.

The vulnerability affects the Hinemos application from NTT DATA INTELLILINK Corporation. No specific product versions have been disclosed in the advisory.

The CVSS score of 7.1 indicates a high severity impact, while the EPSS score is not available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector requires the attacker to have access to the password change API with a set of permissive roles and to be able to invoke that API, implying that the exploit can be carried out by an authenticated, non‑administrative user who has been granted the offending permission. The absence of an EPSS value and lack of known exploits suggest that exploitation is plausible but may not yet be widespread in the wild.