{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "03abbd35af24e55368ce4e09f4038dc2aba3ff5f"
            }
          ],
          "repo": "https://github.com/lenve/vhr",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85182.json"
  },
  "details": "vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.",
  "id": "CVE-2026-85182",
  "modified": "2026-10-08T02:30:28.809099551Z",
  "published": "2026-09-03T14:12:20.455Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85182.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85182"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-pass-allows-cross-account-password-change"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/lenve/vhr/issues/350"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lenve/vhr"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-service/src/main/java/org/javaboy/vhr/service/HrService.java"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change"
}