CVE-2026-109849: High severity vulnerability
Published Nov 5, 2026
·Updated
Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.
Event History
Nov 5, 2026
CVE Published
via MITRE·12:40 AM
Data Sourced
via MITRE·12:40 AM
DescriptionSeverity
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Hinemos deployments are exposed where non-administrative users have permissions that allow access to the password change API. Those permissions can be assigned to non-administrative users.
2
What does an attacker need to exploit it?
An attacker needs access to the password change API and the specific permissions required to use it. No user interaction is required.
3
What is the impact of successful exploitation?
The attacker may change the password of an administrative user, which can enable compromise of that administrative account.