Lenve vhr contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators’ BCrypt password hashes via the GET /chat/hrs endpoint. The disclosed hashes can be used for offline cracking and privilege escalation, as low-privileged operators can also obtain administrators’ phone numbers and addresses from the serialized Hr entity.

The affected product is Lenve vhr. The flaw exists in the code present at commit 03abbd3; all earlier releases that have not applied the commit are vulnerable. No specific version ranges are provided, and the patch applies to any deployment that has not updated beyond this commit.

The CVSS score of 7.1 indicates a high-severity information disclosure. EPSS is not available, so the exploitation likelihood cannot be quantified, but the existence of authenticated access to a public endpoint makes exploitation straightforward if credentials are compromised. The vulnerability is not listed in CISA’s KEV catalog, suggesting that there is no confirmed widespread exploitation yet.