CVE-2026-110217: Lenve vhr Information Disclosure Flaw

CVE-2026-110217 Overview

CVE-2026-110217 is an information disclosure vulnerability in the Lenve vhr (Vue + Spring Boot HR management) application through commit 03abbd3. The GET /chat/hrs endpoint returns the fully serialized Hr entity for every operator, including BCrypt password hashes, phone numbers, and addresses. Any authenticated low-privileged operator can call the endpoint and harvest credentials belonging to administrators. The weakness is tracked as [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Authenticated operators can retrieve administrator BCrypt password hashes and personally identifiable information, enabling offline password cracking and vertical privilege escalation.

Affected Products

Lenve vhr (javaboy/vhr) through commit 03abbd35af24e55368ce4e09f4038dc2aba3ff5f
vhr-web module ChatController (/chat/hrs endpoint)
vhr-mapper HrMapper and vhr-model Hr entity classes

Discovery Timeline

2026-10-13 - CVE-2026-110217 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110217

Vulnerability Analysis

The vhr application exposes a chat subsystem that lists peer operators (Hr entities) available for messaging. The ChatController handler for GET /chat/hrs invokes the HrMapper to query all human-resource users and returns the resulting objects directly in the HTTP response body. Because the Hr model class does not annotate sensitive fields with @JsonIgnore and the MyBatis mapper selects all columns, the serialized JSON includes the password column that stores BCrypt hashes, along with phone, address, and other personal attributes.

Any authenticated session, including low-privileged operator accounts, is sufficient to reach the endpoint. The returned hashes can be subjected to offline cracking with tools such as hashcat. Recovered administrator credentials grant full control over the HR platform, resulting in vertical privilege escalation.

Root Cause

The root cause is over-exposure of a persistence entity in a web response. The MyBatis HrMapper.xml select statement retrieves every column of the hr table, and the Hr POJO lacks serialization filters for the password field. The controller returns the object list without a Data Transfer Object (DTO) mapping, so Jackson includes every field during response serialization.

Attack Vector

Exploitation requires an authenticated low-privileged account on the vhr instance. The attacker sends an HTTP GET request to /chat/hrs using the session cookie or token. The JSON response contains an array of Hr records with the password field populated. No specialized tooling is required; curl or a browser developer console is sufficient to retrieve the data. Refer to the VulnCheck VHR Advisory and the HackMD Chat HRS Disclosure for a full technical walkthrough.

No verified proof-of-concept exploit code is published alongside this advisory. The vulnerable code paths are visible in the GitHub VHR Chat Controller, the GitHub VHR Mapper XML, and the GitHub VHR Model Class.

Detection Methods for CVE-2026-110217

Indicators of Compromise

HTTP access log entries showing GET /chat/hrs requests from accounts that do not use the chat feature.
Unusual response sizes on the /chat/hrs endpoint consistent with full Hr table dumps.
Password-spray or administrator login attempts shortly after /chat/hrs access by a low-privileged operator.

Detection Strategies

Review application logs for repeated /chat/hrs requests from a single session or IP address.
Enable response-body logging in a reverse proxy or Web Application Firewall (WAF) and alert when password fields appear in outbound JSON for the /chat/hrs route.
Compare the account that invoked /chat/hrs against subsequent administrator authentication events to identify credential-replay patterns.

Monitoring Recommendations

Forward vhr access logs and Spring Boot application logs to a centralized SIEM for correlation.
Baseline normal /chat/hrs traffic and alert on volume spikes or non-chat user agents.
Monitor BCrypt-cracking indicators externally, such as leaked credentials appearing in breach feeds matching HR operator email addresses.

How to Mitigate CVE-2026-110217

Immediate Actions Required

Restrict access to /chat/hrs with an authorization check that limits exposure to the minimum required fields.
Rotate BCrypt password hashes for all administrator and operator accounts and enforce a password reset.
Temporarily disable the chat subsystem if it is not operationally required.

Patch Information

No upstream fix commit is referenced in the advisory at the time of publication. Operators of the Lenve vhr project should track the repository for a maintainer release and apply a local patch in the interim. The recommended fix is to introduce a dedicated DTO for /chat/hrs responses that excludes the password, phone, and address fields, or to annotate those fields on the Hr entity with @JsonIgnore.

Workarounds

Modify HrMapper.xml so the select statement used by the chat endpoint omits the password, phone, and address columns.
Add @JsonIgnore to sensitive fields in the Hr model class to prevent serialization in any controller response.
Place /chat/hrs behind an administrator-only role check using Spring Security @PreAuthorize("hasRole('ADMIN')") until a dedicated DTO is implemented.

bash

# Configuration example: block /chat/hrs at an upstream Nginx reverse proxy
location = /chat/hrs {
    deny all;
    return 403;
}