HIGH 7.2 NVD
CVE-2026-85214
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
References
- https://github.com/lenve/vhr
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/v
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/v
- https://github.com/lenve/vhr/issues/349
- https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbit
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-09-03 via NVD.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.