CVE-2026-90501
Received Received - Intake

Improper Privilege Management in lenve vhr 1.0-SNAPSHOT

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90501
EUVD
EUVD-2026-76974

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a mass assignment vulnerability in the vhr application (CVE-2026-90501). A low-privilege user can exploit the PUT /hr/info endpoint to escalate privileges to an admin role by sending a crafted JSON request that includes another user's ID (e.g., admin) and sets a new BCrypt-hashed password. The root cause is the HrInfoController.updateHr() method, which binds request data to the Hr object without verifying ownership, combined with HrMapper.xml allowing password updates when present.

Detection Guidance

Check for unusual PUT requests to /hr/info endpoints with modified user IDs or password fields. Monitor logs for privilege escalation attempts or unauthorized admin role assignments. Use network traffic analysis tools to detect crafted JSON payloads containing admin IDs and BCrypt password hashes.

Impact Analysis

An attacker with low privileges can escalate to admin access, gaining full control over the application. This includes accessing sensitive data, modifying user accounts, and performing unauthorized actions. The exploit is performed remotely and requires no special conditions beyond network access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable the PUT /hr/info endpoint if possible. Implement strict input validation to prevent mass assignment by binding updates only to the session user's ID. Block modifications to sensitive fields like password, username, or enabled status via this endpoint. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart