Executive brief
vhr is an open-source human resources management system. A flaw in the password change endpoint allows authenticated users to reset any colleague's password without authorization, since the system fails to verify that the account ID being modified belongs to the person making the request. An attacker could hijack any employee account by changing their password.
Technical details
The vulnerability is a horizontal privilege escalation (authorization bypass) in the PUT /hr/pass endpoint. The updateHrPasswd() method in HrService.java validates the old password but does not check whether the hrid (account ID) being modified belongs to the authenticated caller. An authenticated attacker can supply any valid account ID and that account's current password (obtained via reconnaissance or social engineering) to reset the target account's password. The vulnerability affects vhr through commit 03abbd3; patches and fixes are assumed available in later commits.
Affected products
- lenve vhr through commit 03abbd3
Timeline
- 2026-09-03: disclosed