CVE-2026-85182: vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be authenticated and able to submit a PUT request to /hr/pass. They also need the target account ID and that account's current password.
Who is exposed to cross-account password changes?
Any account whose ID and current password are known to an authenticated attacker may be targeted. The vulnerable endpoint does not verify that the supplied account ID belongs to the authenticated caller.
How can I determine whether my deployment is affected?
Review the implementation of PUT /hr/pass and verify whether it checks that the account ID in the request matches the authenticated user. The issue is described in vhr through commit 03abbd3.