{"id":"CVE-2026-90501","state":"PUBLISHED","title":"lenve vhr HrMapper.xml HrInfoController.updateHr privileges management","description":"A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-13T08:00:10.471Z","updatedAt":"2026-09-16T13:57:56.833Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["lenve vhr"],"affected":[{"vendor":"lenve","product":"vhr","versions":[{"version":"1.0-SNAPSHOT","status":"affected"}],"cpes":["cpe:2.3:a:lenve:vhr:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/403089","https://vuldb.com/vuln/403089/cti","https://vuldb.com/cve/CVE-2026-90501","https://vuldb.com/submit/892904","https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-001-mass-assignment-privesc.md"],"weaknesses":["CWE-269","CWE-266"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90501.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90501","state":"PUBLISHED","datePublished":"2026-09-13T08:00:10.471Z","dateUpdated":"2026-09-16T13:57:56.833Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-12T08:24:13.076Z"},"containers":{"cna":{"title":"lenve vhr HrMapper.xml HrInfoController.updateHr privileges management","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"lenve","product":"vhr","versions":[{"version":"1.0-SNAPSHOT","status":"affected"}],"cpes":["cpe:2.3:a:lenve:vhr:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/403089","name":"VDB-403089 | lenve vhr HrMapper.xml HrInfoController.updateHr privileges management","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/403089/cti","name":"VDB-403089 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-90501","name":"CVE-2026-90501 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892904","name":"Submit #892904 | lenve vhr 1.0-SNAPSHOT Improper Input Validation","tags":["third-party-advisory"]},{"url":"https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-001-mass-assignment-privesc.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","type":"CWE","lang":"en","description":"Improper Privilege Management"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-13T08:00:10.471Z"},"timeline":[{"time":"2026-09-12T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-12T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-12T10:29:30.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"huluwa888 (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-16T13:57:45.816335Z","id":"CVE-2026-90501","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-16T13:57:56.833Z"}}]}}}