CVE-2026-85182: Lenve Vhr

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

Affected products

• Lenve Vhr

Published 2026-09-03. Last modified 2026-09-10.