Authorization Bypass in vhr HR Profile Endpoint

The vhr application exhibits a critical authorization flaw (CVE-2026-85214) within the PUT /hr/info endpoint. This vulnerability stems from improper validation of user authorization when processing update requests. Authenticated users can manipulate the application state by supplying an arbitrary profile ID within the request body, bypassing intended access controls. This allows a malicious actor to overwrite sensitive HR data, such as addresses and display names, or maliciously modify account statuses, including those of administrative users. Successful exploitation results in data integrity loss and potential denial of service by disabling critical administrative accounts. This issue is specific to the vhr platform and represents a significant risk for organizations relying on this software for employee lifecycle and personnel management.

Impact

Successful exploitation allows authenticated users to perform unauthorized modifications of arbitrary HR profiles. The impact includes the corruption of sensitive employee information and a denial-of-service capability by disabling administrator accounts, potentially leading to a total loss of application control and organizational disruption.

Recommendation

Deploy the Sigma rule below to detect abnormal PUT requests targeting the /hr/info endpoint that may indicate unauthorized profile modification attempts. Ensure audit logging is enabled for all modifications to HR records within the vhr application to assist in the identification of unauthorized profile ID changes. Prioritize patching the vhr platform as soon as a fix is provided by the vendor.