CVE-2026-85214
Received Received - Intake

Unauthorized Profile Modification in vhr

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85214
EUVD
EUVD-2026-70492

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lenve vhr to 03abbd35af24e55368ce4e09f4038dc2aba3ff5f (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85214 is an authorization bypass vulnerability in the vhr application's PUT /hr/info endpoint. It allows authenticated users to overwrite any HR profile by supplying a different profile ID in the request body. Attackers can modify sensitive data like names and addresses, and even disable accounts including administrators, causing denial of service.

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to the /hr/info endpoint. Check if the request body includes a user ID parameter that does not match the authenticated user's ID. Use tools like curl to test if modifying another user's profile is possible with a low-privilege account.

Impact Analysis

This vulnerability allows attackers to modify or disable any user account, including administrators. This can lead to data breaches, unauthorized access, service disruption, and loss of sensitive information. Users may experience account lockouts or unauthorized changes to their personal data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized modification or deletion of personal data, which conflicts with GDPR's data integrity and security principles and HIPAA's access control requirements. Organizations using affected vhr versions may face regulatory penalties.

Mitigation Strategies

Immediately update vhr to a version beyond commit 03abbd35af24e55368ce4e09f4038dc2aba3ff5f. Implement server-side checks to ensure the user ID in the request matches the authenticated user's ID before processing updates. Restrict access to the PUT /hr/info endpoint to authorized roles only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart