CVE-2026-90501: lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges. It can be exploited remotely and does not require user interaction.
What component and input should defenders focus on when assessing exposure?
The affected path is HrInfoController.updateHr in HrMapper.xml. The issue is triggered through manipulation of the Password argument, leading to improper privilege management.
Is exploit activity a practical concern?
A public exploit has been disclosed, so exploitation may be feasible for attackers with the required low-level access. The reported exploit maturity is proof-of-concept.
Is a vendor fix available?
The provided information does not identify a fix or vendor response. The vendor was contacted early about the disclosure but did not respond.