Description
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized password change via improper authorization
Action: Monitor
AI Analysis

Impact

A flaw in Lenve VHR version 1.0‑Snapshot allows an attacker to manipulate the hrid argument in the HrInfoController.updatePass function, enabling them to change the password of any user without proper authorization. This results in unauthorized credential modification, allowing an attacker to assume the identity of any user, potentially leading to broader account compromise and data theft. The weakness is an improper authorization flaw, classified as CWE-266 and CWE-285.

Affected Systems

The vulnerability affects the Lenve VHR version 1.0‑Snapshot Password Update Handler component. No other versions were listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% indicates a very low likelihood of exploitation, but the vulnerability is publicly available and can be executed remotely. The vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out remotely by manipulating an HTTP request to /hr/pass, and the exploit has already been released to the public.

Generated by OpenCVE AI on September 15, 2026 at 17:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or upgrade to a fixed version of Lenve VHR when available.
  • Modify the /hr/pass endpoint so that only users with administrative privileges can invoke it, implementing strict role‑based access authentication for all user accounts to reduce the impact of compromised credentials.
  • Regularly review authentication and password‑change logs for suspicious activity.
  • Disable or remove unused or idle user accounts to limit the attack surface.

Generated by OpenCVE AI on September 15, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title lenve vhr Password Update pass HrInfoController.updatePass improper authorization
First Time appeared Lenve
Lenve vhr
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:lenve:vhr:*:*:*:*:*:*:*:*
Vendors & Products Lenve
Lenve vhr
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Lenve Vhr
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-21T16:18:40.745Z

Reserved: 2026-09-12T08:24:06.621Z

Link: CVE-2026-90499

cve-icon Vulnrichment

Updated: 2026-09-21T16:18:38.008Z

cve-icon NVD

Status : Deferred

Published: 2026-09-13T07:17:41.767

Modified: 2026-09-21T17:19:15.043

Link: CVE-2026-90499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T17:30:10Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization