CVE-2026-109849
Received Received - Intake

Privilege Escalation in Hinemos via Password Change API

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: JPCERT/CC

Description
Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-109849
EUVD
EUVD-2026-117201

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect privilege assignment issue in Hinemos software. It allows an attacker with specific non-administrative permissions to change the password of an administrative user via the password change API. This could lead to unauthorized privilege escalation and full control over the system.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain administrative access to the system by changing the password of an admin user. This may lead to unauthorized system control, data breaches, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Hinemos versions may face legal and regulatory penalties due to insufficient access controls.

Mitigation Strategies
  • Apply the cumulative patch or update to a fixed version of Hinemos (ver.6.0.0 to 7.2.0).
  • If using OSS version, download and apply the fixed package from GitHub.
  • If patching is not possible, review and adjust user role permissions to restrict unauthorized access.
  • For unsupported versions, consider upgrading or applying workarounds as recommended by the developer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...