This vulnerability in lenve vhr 1.0-SNAPSHOT involves improper authorization in the HrInfoController.updatePass function within the /hr/pass endpoint of the Password Update Handler component. Manipulating the hrid parameter enables unauthorized remote attackers to perform password updates. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability. Public exploit code is available, but no vendor response or patch has been provided.

An attacker can remotely exploit this vulnerability to update passwords without proper authorization, potentially leading to unauthorized access or account takeover. The impact is limited to the affected function and does not indicate full system compromise. The CVSS score reflects a medium severity risk due to the ease of exploitation and partial impact on system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should implement compensating controls such as restricting access to the /hr/pass endpoint, monitoring for suspicious password update attempts, and applying strict access controls until an official patch is available.