CVE-2026-90499
Received Received - Intake

Improper Authorization in lenve vhr Password Update Handler

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90499
EUVD
EUVD-2026-76971

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arrestx vhr 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the vhr application version 1.0-SNAPSHOT. It exists in the password update function HrInfoController.updatePass at the endpoint /hr/pass. The flaw allows a logged-in user to change another user's password by manipulating the 'hrid' parameter, which should be restricted to the session user's ID. The vendor did not respond to the disclosure attempt.

Detection Guidance

To detect this IDOR vulnerability, check if the application allows modifying the 'hrid' parameter in the password update endpoint. Send a PUT request to /hr/pass with a known user's ID in 'hrid' while authenticated as a different user. If the password changes for the target user, the vulnerability exists. Example using curl: curl -X PUT -H 'Content-Type: application/json' -d '{"hrid":"TARGET_USER_ID","oldPassword":"oldpass","newPassword":"newpass"}' http://TARGET_IP/hr/pass

Monitor logs for unusual password change requests or failed authorization attempts. Ensure the application validates session user IDs against the 'hrid' parameter.

Impact Analysis

An attacker with access to a valid account could change passwords of other users, leading to account takeover. This is especially dangerous if combined with weak or default passwords. The exploit is remotely executable and a public proof of concept exists.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. It may result in non-compliance with access control and integrity requirements.

Mitigation Strategies

Immediately patch the application by updating the HrInfoController.updatePass() method to ignore the 'hrid' parameter and use only the authenticated user's ID for password changes. If a patch is unavailable, implement server-side validation to enforce that the 'hrid' matches the session user's ID.

Temporarily disable the password change endpoint if mitigation is not possible. Rotate all user passwords as a precaution, especially if default or weak passwords were used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart