# CVE-2026-85182: vhr privilege escalation via password change endpoint

Source: https://junglewise.ai/threats/cve-2026-85182-vhr-privilege-escalation-via-password-change-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85182 · Severity: high · CVSS 7.5 · Published 2026-09-03

vhr is an open-source human resources management system. A flaw in the password change endpoint allows authenticated users to reset any colleague's password without authorization, since the system fails to verify that the account ID being modified belongs to the person making the request. An attacker could hijack any employee account by changing their password.

Technologies: [Lenve Vhr](https://junglewise.ai/threats/technologies/vhr). Vendors: [Lenve](https://junglewise.ai/threats/vendors/lenve).

## Quick answers

**Is CVE-2026-85182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85182 being exploited in the wild.

**How severe is CVE-2026-85182?** High severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** Lenve Vhr through commit 03abbd3.

**Is there a fix for CVE-2026-85182?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85182 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85182?** Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a horizontal privilege escalation (authorization bypass) in the PUT /hr/pass endpoint. The updateHrPasswd() method in HrService.java validates the old password but does not check whether the hrid (account ID) being modified belongs to the authenticated caller. An authenticated attacker can supply any valid account ID and that account's current password (obtained via reconnaissance or social engineering) to reset the target account's password. The vulnerability affects vhr through commit 03abbd3; patches and fixes are assumed available in later commits.

## Affected products

- lenve vhr through commit 03abbd3

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/lenve/vhr](https://github.com/lenve/vhr)
- [https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-service/src/main/java/org/javaboy/vhr/service/HrService.java](https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-service/src/main/java/org/javaboy/vhr/service/HrService.java)

## Related threats

- [Lenve vhr information disclosure in HR endpoint](https://junglewise.ai/threats/cve-2026-110217-lenve-vhr-through-commit-03abbd3-contains-an-information)
- [lenve vhr mass assignment privilege escalation in HrInfoController](https://junglewise.ai/threats/cve-2026-90501-lenve-vhr-mass-assignment-privilege-escalation-in)
- [Lenve VHR unrestricted file upload in avatar upload](https://junglewise.ai/threats/cve-2026-90500-lenve-vhr-unrestricted-file-upload-in-avatar-upload)
- [lenve vhr password change improper authorization](https://junglewise.ai/threats/cve-2026-90499-lenve-vhr-password-change-improper-authorization)
- [lenve vhr default credentials in seed data](https://junglewise.ai/threats/cve-2026-90498-lenve-vhr-default-credentials-in-seed-data)