CVE-2026-85182: Authorization Bypass Through User-Controlled Key in lenve vhr

The lenve vhr product, through commit 03abbd3, contains an authorization bypass vulnerability identified as CVE-2026-85182. The flaw occurs because the PUT /hr/pass endpoint fails to verify that the account ID provided in the request body matches the authenticated caller's account. Authenticated attackers with low privileges can exploit this by supplying a target account ID and that account's current password, allowing them to change arbitrary account passwords without proper authorization.

This vulnerability allows authenticated attackers with limited privileges to change passwords of arbitrary accounts, potentially leading to unauthorized account access or privilege escalation. The CVSS 4.0 score is 7.7 (high severity), reflecting the network attack vector, partial attack complexity, and significant impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious password change activity.