CVE-2026-110217 — vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET …
Published: 2026-10-13 · CVSS: 7.1 · CVSS 4.0
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7