What is CVE-2026-85214?

CVE-2026-85214 is a high-severity vulnerability, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-09-03.

How severe is CVE-2026-85214?

High severity. CVSS v3 base score is 8.1 out of 10.

CVE-2026-85214

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com

Frequently asked questions

What is CVE-2026-85214?: CVE-2026-85214 is a high-severity vulnerability, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-09-03.
How severe is CVE-2026-85214?: High severity. CVSS v3 base score is 8.1 out of 10.