The vulnerability arises because the service handling the PUT /hr/pass endpoint does not verify that the account ID supplied in the request matches the authenticated caller, allowing an attacker who is already authenticated to submit arbitrary account IDs and passwords. This missing authorization check can be used to change the password of any other user, effectively enabling a compromise of additional accounts and providing full control over them. The flaw is documented as CWE‑639: Authorization Bypass Through User-Controlled Key.

The issue affects deployments of the lenve vhr application, specifically any location that contains the code in the vhr service and web controller files referenced in the GitHub commits noted in the advisory. No specific release numbers are listed, but any release that includes or predates commit 03abbd3 may be vulnerable.

The CVSS score for this vulnerability is 7.7, indicating moderate to high severity. The EPSS score is not available, so current exploitation probability cannot be quantified, but the lack of an explicit KEV listing suggests no known widespread exploitation yet. The attacker must already be authenticated to the system, so the attack vector is likely an authenticated API call to PUT /hr/pass. Once authenticated, the attacker can change the password of any target account by providing that account’s current password, potentially leading to complete takeover of victim accounts.