A critical authorization bypass vulnerability in the vhr application allows authenticated attackers to modify or disable sensitive HR user accounts.

This is an insecure direct object reference (CWE-639) occurring within the HrInfoController class. The application fails to validate whether the authenticated user has permission to modify the target profile ID supplied in the request body of the PUT /hr/info endpoint.

Successful exploitation permits an authenticated user to perform unauthorized modifications to any HR account within the system. This risk includes the ability to alter personal contact information or disable administrative accounts, which can lead to significant service disruption and unauthorized administrative privilege manipulation. Given the CVSS score of 8.1, the potential for high integrity and availability impact necessitates immediate attention.

Immediate Action: Since a specific patch version is currently unavailable, administrators should restrict access to the /hr/info endpoint at the network level until the vendor releases an official security update.

Proactive Monitoring: Review application access logs for PUT requests directed at the /hr/info endpoint, specifically monitoring for instances where the ID in the request body does not match the ID of the authenticated session user.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect request bodies and block unauthorized attempts to modify profile IDs that do not belong to the currently authenticated principal.

Public Exploit Available: Unknown

This high-severity vulnerability poses a substantial risk to internal data integrity and system availability. Security teams must prioritize identifying and restricting access to the vulnerable endpoint while awaiting a formal patch from the vendor to prevent potential account takeover or denial-of-service scenarios.