Description

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T15:17:39.593Z",
  "pubdate": "2026-09-03T15:17:39.593Z",
  "executiveSummary": "The vhr application, through commit 03abbd3, contains a critical broken access control vulnerability within the PUT /hr/pass request handler.\nThis flaw stems from a lack of server-side validation ensuring that the account ID specified in the request body matches the identity of the currently authenticated session.\nThe vulnerability allows an authenticated attacker to perform an Insecure Direct Object Reference (IDOR) attack to modify the credentials of any account within the system.\nExploitation requires the attacker to possess a valid authentication token for the service and knowledge of a target account's current password.\nSuccessful exploitation results in full account takeover, allowing the adversary to impersonate any user, including administrative accounts, thereby compromising the confidentiality, integrity, and availability of user data.\nThe risk level is classified as high due to the potential for unauthorized account modification and subsequent privilege escalation.",
  "technicalDetails": "The vulnerability resides in the backend logic processing the PUT /hr/pass endpoint. The system fails to implement proper authorization checks to verify that the principal associated with the authenticated session is the authorized owner of the target account ID provided in the payload.\nThe root cause is an improper trust assumption where the application processes the account ID parameter from the user-supplied request body without cross-referencing it against the authenticated user's session context or authorization token.\nIn a standard attack flow, an authenticated attacker initiates a PUT request to /hr/pass. The request body includes the target account identifier and the victim's existing password. Because the application logic does not validate ownership, the server proceeds to update the password for the specified target account rather than restricting the operation to the authenticated user's own profile.\nThe technical requirement for exploitation involves an attacker first obtaining a valid, authenticated session within the vhr environment. While the attacker must provide the victim's existing password to complete the request, this requirement does not sufficiently mitigate the impact, as it facilitates targeted unauthorized account modification or mass credential manipulation if the attacker has obtained a list of valid password pairs.\nThe vulnerability affects all versions of vhr through commit 03abbd3. The component responsible is the password update handler, which neglects to enforce object-level authorization (BOLA/IDOR).\nPost-exploitation, an attacker can effectively seize control of any target account. By overwriting the password, the attacker can subsequently authenticate as the victim, access private user data, and execute privileged actions depending on the target's role. This vulnerability effectively bypasses account isolation mechanisms, posing a significant threat to the security posture of the vhr application."
}