CVE-2026-85182

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

  • Published Sep 3, 2026
  • CVSS 7.7 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-85182 at the National Vulnerability Database