CVE-2026-85214: vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the application. The attacker does not need user interaction and can target other HR profiles, including administrator accounts.
What access is needed to overwrite another profile?
The affected endpoint accepts a profile ID supplied in the request body without validating that the authenticated user is authorized to modify that profile. An authenticated user who can send a PUT request to /hr/info can provide another user's profile ID.
What is the practical impact?
An attacker can overwrite other users' names and addresses and can disable accounts. Disabling administrator accounts can cause denial of service.
How can I tell whether an attempted exploitation occurred?
Review PUT /hr/info requests for profile IDs that do not belong to the authenticated requester, and investigate unexpected changes to HR profile fields or account disablement, particularly for administrator accounts.