Description

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-13T07:17:41.767Z",
  "pubdate": "2026-09-13T07:17:41.767Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in lenve vhr 1.0-SNAPSHOT within the Password Update Handler component.\nThe flaw stems from insufficient validation of the 'hrid' argument within the 'HrInfoController.updatePass' function, allowing unauthorized actors to perform sensitive operations.\nThe vulnerability is remotely exploitable, requiring no complex prerequisites beyond network connectivity to the target application.\nBecause the exploit is publicly available, the risk to confidentiality, integrity, and availability is elevated, particularly as the vendor has failed to respond to disclosure efforts.\nSuccessful exploitation allows an attacker to bypass standard security controls, potentially resulting in unauthorized password modifications or account takeovers.\nOrganizations deploying this version are at significant risk as the lack of vendor support necessitates immediate internal compensatory controls.",
  "technicalDetails": "The vulnerability resides in the 'HrInfoController.updatePass' function, located within the '/hr/pass' endpoint of the lenve vhr 1.0-SNAPSHOT application. The core issue is an improper authorization flaw resulting from the application's failure to adequately verify that the requester has the appropriate permissions to modify the password associated with the provided 'hrid' argument.\nIn a secure implementation, the server should validate that the authenticated session corresponds to the 'hrid' provided in the request body or parameters. Instead, the application trusts the 'hrid' input provided by the client without performing secondary server-side checks to verify the ownership of the account being modified. This architectural oversight allows an attacker to manipulate the request by supplying an arbitrary 'hrid', forcing the application to execute a password change against the unintended target.\nThe attack flow begins with the attacker identifying the target 'hrid' through reconnaissance or predictable naming schemes. The attacker then constructs a crafted HTTP request targeting the '/hr/pass' endpoint. By injecting the target's identifier into the 'hrid' parameter, the attacker bypasses the intended authorization logic. The server-side controller proceeds to execute the update operation under the assumption that the request was authorized, resulting in a state change where the victim's password is reset or modified by the attacker.\nThis vulnerability is classified as remotely exploitable, as it does not require physical access to the server or specialized local permissions. The lack of robust authorization checks at the controller level effectively transforms a sensitive administrative function into an open attack surface. The impact of this exploit is severe, as it facilitates account takeover (ATO), enabling unauthorized access to sensitive HR data and system functions controlled by the compromised account. Given the public availability of the exploit code, the barrier to entry for potential attackers is extremely low, and the lack of vendor remediation significantly increases the window of exposure for affected deployments."
}