# CVE-2026-110217: Lenve vhr information disclosure in HR endpoint

Source: https://junglewise.ai/threats/cve-2026-110217-lenve-vhr-through-commit-03abbd3-contains-an-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110217 · Severity: medium · CVSS 6.5 · Published 2026-10-13

Lenve vhr is a human resources management system built with Spring Boot and Vue. The vulnerability allows any authenticated user to retrieve password hashes, phone numbers, and addresses of other HR operators through an exposed API endpoint, enabling attackers to crack administrator passwords and escalate privileges.

Technologies: [Lenve Vhr](https://junglewise.ai/threats/technologies/vhr). Vendors: [Lenve](https://junglewise.ai/threats/vendors/lenve).

## Quick answers

**Is CVE-2026-110217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110217 being exploited in the wild.

**How severe is CVE-2026-110217?** Medium severity, with a CVSS score of 6.5, published 13 October 2026.

**Which products and versions are affected?** Lenve Vhr through commit 03abbd3.

**Is there a fix for CVE-2026-110217?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110217 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110217?** Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass allows authenticated users to access the GET /chat/hrs endpoint and retrieve the complete Hr entity data for all operators, including bcrypt password hashes. The vulnerable HrMapper.xml queries return password fields without proper access control, enabling low-privileged operators to harvest administrator credentials for offline cracking and lateral movement.

## Affected products

- Lenve vhr through commit 03abbd3

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/lenve/vhr](https://github.com/lenve/vhr)
- [https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml](https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml)

## Related threats

- [lenve vhr mass assignment privilege escalation in HrInfoController](https://junglewise.ai/threats/cve-2026-90501-lenve-vhr-mass-assignment-privilege-escalation-in)
- [Lenve VHR unrestricted file upload in avatar upload](https://junglewise.ai/threats/cve-2026-90500-lenve-vhr-unrestricted-file-upload-in-avatar-upload)
- [lenve vhr password change improper authorization](https://junglewise.ai/threats/cve-2026-90499-lenve-vhr-password-change-improper-authorization)
- [lenve vhr default credentials in seed data](https://junglewise.ai/threats/cve-2026-90498-lenve-vhr-default-credentials-in-seed-data)
- [Lenve VHR MailReceiver deserialization RCE](https://junglewise.ai/threats/cve-2026-90490-lenve-vhr-mailreceiver-deserialization-rce)