CVE-2026-85182 — vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account…
Published: 2026-09-03 · CVSS: 7.7 · CVSS 4.0
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7