Is CVE-2026-85182 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85182?

CVE-2026-85182 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-85182

Description

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.