CVE-2026-110217

Published: Oct 13, 2026Modified: Oct 14, 2026

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (7)

https://github.com/lenve/vhr

Source: disclosure@vulncheck.com

https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml#L26-L28

Source: disclosure@vulncheck.com

https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-model/src/main/java/org/javaboy/vhr/model/Hr.java#L138-L140

Source: disclosure@vulncheck.com

https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/ChatController.java#L12-L20

Source: disclosure@vulncheck.com

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vhr-chat-hrs-password-disclosure

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/vhr-through-commit-03abbd3-information-disclosure-of-operator-password-hashes-via-get-chat-hrs

Source: disclosure@vulncheck.com

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vhr-chat-hrs-password-disclosure

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.