---
id: CVE-2026-85214
title: >-
  vhr fails to validate user authorization in the PUT /hr/info endpoint,
  allowing authenticated users to modify arbitrary HR profiles by supplying any
  profile ID in the request body
summary: >-
  vhr fails to validate user authorization in the PUT /hr/info endpoint,
  allowing authenticated users to modify arbitrary HR profiles by supplying any
  profile ID in the request body. Attackers can overwrite other users' names,
  addresses, a…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-639
published: '2026-09-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:53:23.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85214'
references:
  - url: 'https://github.com/lenve/vhr'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java
    label: disclosure@vulncheck.com
  - url: 'https://github.com/lenve/vhr/issues/349'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite
    label: disclosure@vulncheck.com
  - url: 'https://github.com/lenve/vhr/issues/349'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00504
epssPercentile: 0.4055
ingestedAt: '2026-09-10T16:57:28.702Z'
vendor: lenve
product: vhr
affected:
  - vhr <= 03abbd35af24e55368ce4e09f4038dc2aba3ff5f
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-03T14:35:28.018451Z'
---

## Overview

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.