Is CVE-2026-85182 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85182 being exploited in the wild.

How severe is CVE-2026-85182?

High severity, with a CVSS score of 7.5, published 3 September 2026.

Which products and versions are affected?

Lenve Vhr through commit 03abbd3.

Is there a fix for CVE-2026-85182?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85182 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85182?

Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85182: vhr privilege escalation via password change endpoint

CVE-2026-85182 · Severity: high · CVSS 7.5 · Published 2026-09-03

vhr is an open-source human resources management system. A flaw in the password change endpoint allows authenticated users to reset any colleague's password without authorization, since the system fails to verify that the account ID being modified belongs to the person making the request. An attacker could hijack any employee account by changing their password.

Technologies: Lenve Vhr. Vendors: Lenve.

Quick answers

Is CVE-2026-85182 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85182 being exploited in the wild.
How severe is CVE-2026-85182?: High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?: Lenve Vhr through commit 03abbd3.
Is there a fix for CVE-2026-85182?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85182 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85182?: Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a horizontal privilege escalation (authorization bypass) in the PUT /hr/pass endpoint. The updateHrPasswd() method in HrService.java validates the old password but does not check whether the hrid (account ID) being modified belongs to the authenticated caller. An authenticated attacker can supply any valid account ID and that account's current password (obtained via reconnaissance or social engineering) to reset the target account's password. The vulnerability affects vhr through commit 03abbd3; patches and fixes are assumed available in later commits.

Affected products

lenve vhr through commit 03abbd3

Timeline

2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.