{"id":"CVE-2026-85214","state":"PUBLISHED","title":"vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite","description":"vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.","publishedAt":"2026-09-03T14:12:24.540Z","updatedAt":"2026-09-24T14:20:57.471Z","severity":{"score":7.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["lenve vhr"],"affected":[{"vendor":"lenve","product":"vhr","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"03abbd35af24e55368ce4e09f4038dc2aba3ff5f","versionType":"git"}]}],"references":["https://github.com/lenve/vhr/issues/349","https://github.com/lenve/vhr","https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java","https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml","https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/85xxx/CVE-2026-85214.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85214","state":"PUBLISHED","datePublished":"2026-09-03T14:12:24.540Z","dateUpdated":"2026-09-24T14:20:57.471Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-03T13:44:56.330Z"},"containers":{"cna":{"title":"vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite","descriptions":[{"lang":"en","value":"vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service."}],"affected":[{"vendor":"lenve","product":"vhr","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"03abbd35af24e55368ce4e09f4038dc2aba3ff5f","versionType":"git"}]}],"references":[{"url":"https://github.com/lenve/vhr/issues/349","tags":["issue-tracking"],"name":"GitHub Issue #349"},{"url":"https://github.com/lenve/vhr","tags":["product"]},{"url":"https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java","tags":["technical-description"],"name":"HrInfoController.java at 03abbd3"},{"url":"https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml","tags":["technical-description"],"name":"HrMapper.xml at 03abbd3"},{"url":"https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite","name":"VulnCheck Advisory: vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"Authorization Bypass Through User-Controlled Key","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-24T14:20:57.471Z"},"datePublic":"2026-07-05T00:00:00.000Z","credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/lenve/vhr/issues/349","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-03T14:35:28.018451Z","id":"CVE-2026-85214","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-03T14:35:36.723Z"}}]}}}