CVE-2026-90499

lenve vhr Password Update pass HrInfoController.updatePass improper authorization

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in Lenve VHR version 1.0‑Snapshot allows an attacker to manipulate the hrid argument in the HrInfoController.updatePass function, enabling them to change the password of any user without proper authorization. This results in unauthorized credential modification, allowing an attacker to assume the identity of any user, potentially leading to broader account compromise and data theft. The weakness is an improper authorization flaw, classified as CWE-266 and CWE-285.

Affected Systems

The vulnerability affects the Lenve VHR version 1.0‑Snapshot Password Update Handler component. No other versions were listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% indicates a very low likelihood of exploitation, but the vulnerability is publicly available and can be executed remotely. The vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out remotely by manipulating an HTTP request to /hr/pass, and the exploit has already been released to the public.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch or upgrade to a fixed version of Lenve VHR when available.
  • Modify the /hr/pass endpoint so that only users with administrative privileges can invoke it, implementing strict role‑based access authentication for all user accounts to reduce the impact of compromised credentials.
  • Regularly review authentication and password‑change logs for suspicious activity.
  • Disable or remove unused or idle user accounts to limit the attack surface.

Generated by OpenCVE AI on September 15, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title lenve vhr Password Update pass HrInfoController.updatePass improper authorization
First Time appeared Lenve
Lenve vhr
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:lenve:vhr:*:*:*:*:*:*:*:*
Vendors & Products Lenve
Lenve vhr
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 21, 2026, 4:18 PM
Reserved
Sep 12, 2026, 8:24 AM

View source JSON

Updated
Sep 21, 2026, 4:18 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 7:17 AM
Modified
Sep 21, 2026, 5:19 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:30 PM

JSON