VULNERABILITY INTELLIGENCE
CVE-2026-85214
CVSS score7.2 HIGH
EPSS probability0.50%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-09-10
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Weakness classification
- CWE-639: Authorization Bypass Through User-Controlled Key