HIGHVulnerability
CVE-2026-85214
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Properties
- severity
- HIGH
- score
- 8.1
- epss_score
- 0.00273
- cve_id
- CVE-2026-85214
- signal_observed_at
- 2026-09-15T21:12:51+00:00
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- published_at
- 2026-09-03T15:17:40.730
- last_modified
- 2026-09-10T15:53:23.707
- epss_percentile
- 0.19695
Related Entities (3)
ENRICHED_BY (1)
→[Source]FIRST EPSS
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Authorization Bypass Through User-Controlled Key
Explore deeper with Ninja Signal's threat intelligence graph