CVE-2026-90501: lenve vhr Privilege Escalation Vulnerability

CVE-2026-90501 Overview

CVE-2026-90501 is an improper privilege management vulnerability [CWE-266] in lenve vhr version 1.0-SNAPSHOT. The flaw resides in the HrInfoController.updateHr function backed by the HrMapper.xml MyBatis mapping file. An authenticated remote attacker can manipulate the Password argument through mass assignment to modify credential data outside the intended scope. The exploit has been publicly disclosed, though the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can abuse mass assignment on the updateHr endpoint to alter the Password field, enabling horizontal or vertical privilege escalation within the human resources application.

Affected Products

lenve vhr 1.0-SNAPSHOT
Component: HrInfoController.updateHr
File: HrMapper.xml

Discovery Timeline

2026-09-13 - CVE-2026-90501 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90501

Vulnerability Analysis

The vulnerability exists in the updateHr handler of HrInfoController, which passes user-supplied fields to the MyBatis mapping defined in HrMapper.xml. Because the mapper accepts the full HR object without field filtering, the Password attribute is included in the update statement. An authenticated user submitting an HR update request can inject a Password field into the payload and overwrite credentials for the target account.

This is a classic mass assignment flaw leading to improper privilege management. Successful exploitation allows an attacker with low privileges to change passwords of other HR accounts, then authenticate as those users. The attack is network-reachable and requires no user interaction beyond a valid session.

Root Cause

The root cause is a lack of allow-listing on writable fields in the update flow. The HrMapper.xml update statement binds every property from the incoming HR object directly to SQL columns, including password. The controller does not strip sensitive fields before forwarding the object to the persistence layer, violating the principle of least privilege for data mutation.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the HR update endpoint served by HrInfoController.updateHr. The JSON or form payload includes a Password field alongside legitimate profile attributes. The MyBatis mapper persists the injected password to the database, and the attacker subsequently logs in as the modified account. Because the vulnerable code path is reachable remotely, exploitation does not require local access.

No verified proof-of-concept code is published. See the GitHub VHR Advisory #001 and VulDB CVE-2026-90501 Details for the disclosed technical write-up.

Detection Methods for CVE-2026-90501

Indicators of Compromise

HTTP requests to HR update endpoints containing an unexpected Password or password JSON field in the request body.
Database audit records showing UPDATE statements on the HR user table that modify the password column outside of the dedicated password-change workflow.
Unexpected authentication successes from new source addresses shortly after HR profile update requests.

Detection Strategies

Inspect application logs for calls to HrInfoController.updateHr where the serialized request body includes credential-related properties.
Correlate profile update events with subsequent password-hash changes and login events for the same account within a short time window.
Deploy a web application firewall (WAF) rule that flags JSON payloads to HR endpoints containing keys such as password, salt, or roleId.

Monitoring Recommendations

Enable verbose auditing on MyBatis SQL statements executed against the HR user table and alert on password column mutations.
Monitor Spring MVC binding warnings that indicate unexpected fields being deserialized into controller parameters.
Track anomalous horizontal access patterns where one account modifies multiple distinct HR records in rapid succession.

How to Mitigate CVE-2026-90501

Immediate Actions Required

Restrict access to the vhr application to trusted internal networks until a patch is available, given the vendor did not respond to disclosure.
Force password resets for all HR accounts and invalidate active sessions to eliminate any credentials that may already be attacker-controlled.
Review recent HR update requests for the presence of password fields and audit affected accounts for unauthorized changes.

Patch Information

No vendor patch has been published. The vendor was contacted before disclosure but did not respond, per the advisory. Organizations running lenve vhr 1.0-SNAPSHOT should apply source-level mitigations by explicitly excluding the password field from the updateHr binding and by restricting the HrMapper.xml update statement to a fixed allow-list of non-sensitive columns. Track the VulDB Vulnerability #403089 entry for future fix references.

Workarounds

Modify HrInfoController.updateHr to use a dedicated data transfer object (DTO) that excludes password, salt, and role-related fields.
Update HrMapper.xml so the UPDATE statement enumerates only the columns that should be user-editable, rather than relying on dynamic property binding.
Enforce role-based authorization checks that prevent one HR user from updating records belonging to another HR user.
Deploy a reverse-proxy filter that strips password keys from JSON payloads addressed to HR profile endpoints.

bash

# Example WAF rule concept (ModSecurity) to block Password field in HR update requests
SecRule REQUEST_URI "@beginsWith /hr/updateHr" \
    "phase:2,deny,status:400,id:2690501,\
    msg:'CVE-2026-90501 mass assignment attempt',\
    chain"
  SecRule REQUEST_BODY "@rx (?i)\"password\"\s*:" "t:none"