{"id":"CVE-2026-85214","title":"vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body","summary":"vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, a…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-639"],"published":"2026-09-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:53:23.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85214","references":[{"url":"https://github.com/lenve/vhr","label":"disclosure@vulncheck.com"},{"url":"https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml","label":"disclosure@vulncheck.com"},{"url":"https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java","label":"disclosure@vulncheck.com"},{"url":"https://github.com/lenve/vhr/issues/349","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite","label":"disclosure@vulncheck.com"},{"url":"https://github.com/lenve/vhr/issues/349","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00273,"epssPercentile":0.1994,"ingestedAt":"2026-09-10T16:57:28.702Z","vendor":"lenve","product":"vhr","affected":["vhr <= 03abbd35af24e55368ce4e09f4038dc2aba3ff5f"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-03T14:35:28.018451Z"},"slug":"CVE-2026-85214","body":"## Overview\n\nvhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210218,"id":"CVE-2026-85214","ts":1790264815640,"field":"exploit_available","old":"false","new":"true"}]}