Description

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-03T15:17:40.730Z",
  "pubdate": "2026-09-03T15:17:40.730Z",
  "executiveSummary": "The vhr application is affected by an Insecure Direct Object Reference (IDOR) vulnerability within the PUT /hr/info endpoint. This flaw arises from a failure to perform server-side authorization checks when processing profile update requests. Authenticated users are able to modify arbitrary HR profiles by manipulating the profile ID parameter provided in the request body.\nThe impact of this vulnerability is critical, as it allows unauthorized modification of sensitive user data, including names and physical addresses. Furthermore, it facilitates administrative account takeover or account disablement, leading to a significant denial-of-service (DoS) condition. Because the vulnerability resides in the application's access control logic, any authenticated user—regardless of their privilege level—can target other users, including those with elevated administrative rights. The exploitation requires no specific technical complexity, only the ability to authenticate to the application and craft a malicious JSON payload. This vulnerability represents a severe breach of data integrity and availability, necessitating immediate remediation of the authorization middleware governing the specified API endpoint.",
  "technicalDetails": "The vulnerability exists in the PUT /hr/info endpoint of the vhr application. The root cause is an Improper Authorization flaw where the application logic trusts the user-supplied profile ID provided in the request body without verifying whether the authenticated user possesses the appropriate permissions to modify that specific resource. This lack of object-level authorization allows for horizontal and vertical privilege escalation.\nThe exploitation flow proceeds as follows: First, an authenticated attacker initiates a PUT request to the /hr/info endpoint. Within the request body, the attacker specifies a target profile ID corresponding to another user or an administrator. Because the server fails to validate the ownership or authorization status of the session against the requested resource ID, the application processes the update instruction for the specified profile. By supplying modified fields, the attacker can overwrite the victim's name, contact information, or modify status flags that control account access, such as disabling a user account or modifying its role.\nThe vulnerability is accessible to any authenticated user who has network access to the API endpoint. No specialized tools are required beyond a standard HTTP client or a proxy tool used to intercept and modify request payloads. The attack is effective because the server-side controller treats the input parameter as an implicit instruction to perform an update operation without implementing a lookup to confirm the resource matches the user's scope of authority.\nThe post-exploitation impact includes persistent unauthorized data modification, which compromises the integrity of the HR system. By disabling administrator accounts, the attacker can effectively deny access to authorized personnel, resulting in a denial-of-service condition that hinders the operational capacity of the HR department. Furthermore, the ability to modify names and addresses could be used to facilitate social engineering attacks or to mask malicious actions by masquerading as other legitimate users within the system."
}