CVE-2026-85182

vhr through commit 03abbd3 contains an authorization flaw (CWE-639, user-controlled key / IDOR) in its password-change endpoint, PUT /hr/pass: the server does not verify that the account ID supplied in the request belongs to the authenticated caller. An authenticated user can trigger it by sending a PUT /hr/pass request naming a different target account ID together with that account's current password in the request body. A successful attacker can change the password of arbitrary accounts, enabling takeover of other users' accounts in the HR system (CVSS 4.0 score 7.7, High). Any deployment running vhr at or before commit 03abbd3 is affected, though exploitation requires low-level access to the application and knowledge of the target account's current password, which raises the bar. No exploitation is currently known: EPSS is 0.3% (17th percentile), the flaw is not in CISA KEV, and no public proof-of-concept exists.

What to do: Deploy a vhr build newer than commit 03abbd3 that enforces an ownership check on PUT /hr/pass so the submitted account ID must match the authenticated caller, and check the project repository for the fixed release. Until patched, restrict which users and networks can reach the password-change endpoint and review logs for PUT /hr/pass requests in which the account ID differs from the authenticated caller. Audit for unexpected password changes and reset credentials for any accounts that may have been altered.