Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110217vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
Medium 6.5
In plain English
A medium-severity information exposure in vhr from lenve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- Researcher Advisory third-party-advisory
- Vulnerable Code: ChatController.java at 03abbd3 technical-description
- HrMapper.xml at 03abbd3 technical-description
- Hr.java at 03abbd3 technical-description
- https://github.com/lenve/vhr product
- VulnCheck Advisory: vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs third-party-advisory