Information Disclosure in Lenve vhr via Unauthenticated Chat Endpoint

Executive Summary

CVE-2026-110217 is an information disclosure vulnerability in the Lenve vhr HR system. It allows any authenticated user to access sensitive data via the GET /chat/hrs endpoint. The flaw stems from broken access control and improper serialization of the Hr entity. Attackers can retrieve BCrypt password hashes, phone numbers, addresses, and other personal data of all operators, including administrators.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your vhr system has the endpoint GET /chat/hrs accessible to authenticated users. Send a GET request to /chat/hrs with valid credentials and inspect the response for BCrypt password hashes or other sensitive operator data. Example using curl: curl -X GET http://<target>/chat/hrs -H 'Authorization: Bearer <token>'

If the response contains serialized Hr entities with password hashes or personal information, the system is vulnerable. Verify the Hr model does not exclude the password field during serialization and check if the endpoint lacks proper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged users can exploit this to collect administrator password hashes and other sensitive data. While BCrypt hashes are salted and hard to crack, weak passwords may be compromised. This could lead to full account takeover, privilege escalation, and unauthorized access to sensitive HR information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data (passwords, phone numbers, addresses) and potential exposure of sensitive HR records. It demonstrates inadequate access controls and data protection measures, risking non-compliance with privacy regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Hr model to exclude the password field during serialization using @JsonIgnore or similar annotations. Modify the GET /chat/hrs endpoint to enforce proper authorization checks, ensuring only authorized roles can access it.

Update the SQL query in HrMapper.xml to exclude the password column from results. Restrict access to the /chat/hrs endpoint by updating the permission system to cover this path. Patch to versions beyond commit 03abbd3.

Useful 0 Not Useful 0