CVE-2026-85214

CVE-2026-85214 is a broken-authorization flaw (CWE-639, IDOR) in the vhr HR management system: the PUT /hr/info endpoint does not verify that the authenticated user is authorized to edit the profile whose ID is supplied in the request body. Any authenticated user can therefore send a crafted PUT /hr/info request containing another user's profile ID and modify that record. An attacker gains unauthorized modification of other users' HR data, such as names and addresses, and can disable accounts, including administrator accounts, causing a denial of service; per the CVSS scoring there is no confidentiality impact. All deployments of vhr that expose /hr/info to authenticated users are affected, though the advisory specifies no affected version numbers or fixed release. Exploitation has not been observed: there is no public PoC, the CVE is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.3% (20th percentile).

What to do: Add a server-side authorization check so a PUT /hr/info request can only modify the profile ID belonging to the authenticated caller (or require an elevated role), and until a patch is available restrict the endpoint to trusted users. Audit HR profiles for unexpected name or address changes and check whether any administrator or user accounts were disabled, and review access logs for PUT /hr/info requests that carry profile IDs other than the requester's own. No fixed version is named in the advisory, so monitor the upstream project and the VulnCheck advisory for a patched release.