CVE-2026-110217: vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user, including a low-privileged operator, can request the affected endpoint and retrieve data for other operators.
What does an attacker need to do to exploit it?
The attacker needs valid authenticated access and can query GET /chat/hrs. No user interaction is required.
What information may already have been exposed?
Responses can expose other operators' BCrypt password hashes, phone numbers, and addresses. Administrator password hashes may be collected for offline cracking and potential privilege escalation.
How can I determine whether my deployment is affected?
Check whether the Lenve vhr code includes the affected GET /chat/hrs handling and Hr entity serialization present through commit 03abbd3. An authenticated low-privileged account receiving other operators' password hashes or personal details from that endpoint indicates exposure.