By supplying an arbitrary account ID along with that account's current password in the request body, an attacker can successfully overwrite the credentials for that target account. This vulnerability is highly impactful as it enables privilege escalation or total account takeover, provided the attacker has valid authentication to the platform. This issue was identified as CVE-2026-85182 and represents a failure in backend access control logic that requires immediate attention for systems running vhr versions at or below commit 03abbd3.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to gain unauthorized access to any user account on the platform, including administrative accounts. This leads to complete loss of account integrity and potential exfiltration of sensitive personnel or HR data managed by the application. Because the vulnerability allows an attacker to control the authentication credentials of any target account, the impact is severe, potentially compromising the entire instance of the vhr application.

Recommendation

1. Patch the vhr application immediately by updating to a commit version later than 03abbd3 that includes the authorization fix for the PUT /hr/pass endpoint.
2. Implement request validation logging for the PUT /hr/pass endpoint to identify requests where the authenticated user ID differs from the account ID provided in the payload.
3. Audit application access logs for multiple password change requests originating from a single authenticated session that target different account IDs.