High severity · published Sep 3, 2026
CVE-2026-85214
vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VH
vhr · lenve
through 03abbd35af24e55368ce4e09f4038dc2aba3ff5f · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85214
github.com
https://github.com/lenve/vhr
github.com
https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml
github.com
https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java
github.com
https://github.com/lenve/vhr/issues/349
www.vulncheck.com
https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite
More from vhr
7.5
CVE-2026-85182
vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
7.3
CVE-2026-90498
lenve vhr vhr.sql default credentials
6.5
CVE-2026-110217
vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
6.3
CVE-2026-90501
lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
6.3
CVE-2026-90500
lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload