Executive brief
vhr is an open-source HR management system. The application fails to properly validate that authenticated users can only modify their own HR profiles, allowing attackers to overwrite other employees' personal information (names, addresses) and disable accounts including administrators. This can lead to unauthorized data modification, account lockout, and operational disruption.
Technical details
The vulnerability is a broken access control (CWE-639/CWE-863) in the PUT /hr/info endpoint. The endpoint accepts a profile ID in the request body but does not validate that the authenticated user has permission to modify that specific profile. An authenticated attacker can supply any profile ID to overwrite arbitrary HR records, including disabling admin accounts. The attack requires network access and authentication, but no special privileges. No patch information is provided in the advisory.
Affected products
- lenve vhr <UNKNOWN>
Timeline
- 2026-09-03: disclosed