CVE-2026-109849 is a vulnerability in NTT DATA INTELLILINK Corporation's Hinemos product involving incorrect privilege assignment. An attacker with access to the password change API and specific permissions, which can be assigned to non-administrative users, may change the password of an administrative user. This could lead to unauthorized administrative access.