CVE-2026-6834
Received Received - Intake
Missing Authorization in a+HRD API Allows Remote Data Access

Publication date: 2026-04-22

Last updated on: 2026-04-22

Assigner: TWCERT/CC

Description
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-14
NVD
CVE-2026-6834
EUVD
EUVD-2026-24601
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
aenrich a+hrd *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the a+HRD software developed by aEnrich is a Missing Authorization issue. This means that authenticated remote attackers can exploit a specific API method to read database contents arbitrarily without proper permission checks.

Executive Summary

The vulnerability in the a+HRD software developed by aEnrich is a Missing Authorization flaw. This means that authenticated remote attackers can exploit a specific API method to read database contents arbitrarily without proper permission checks.

Impact Analysis

This vulnerability allows attackers who have some level of authentication to access sensitive database information without authorization. This can lead to exposure of confidential data, potentially causing data breaches and compromising the security of the affected system.

Compliance Impact

The vulnerability in a+HRD developed by aEnrich allows authenticated remote attackers to arbitrarily read database contents through a specific API method due to missing authorization.

This unauthorized data access could potentially lead to exposure of sensitive personal or protected health information, which may result in non-compliance with data protection regulations such as GDPR and HIPAA.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Impact Analysis

This vulnerability allows attackers who have some level of authentication to access sensitive database information without authorization. This can lead to unauthorized disclosure of confidential data, potentially compromising privacy and security.

Executive Summary

The vulnerability in the a+HRD software developed by aEnrich is a Missing Authorization flaw. This means that authenticated remote attackers can exploit a specific API method to read database contents arbitrarily without proper permission checks.

Impact Analysis

This vulnerability allows attackers who have some level of authentication to access sensitive database information without authorization. The impact is a high confidentiality breach, potentially exposing sensitive data stored in the database.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart