vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

The vhr (Virtual HR) application fails to validate user authorization on the PUT /hr/info endpoint. Any authenticated user can modify arbitrary HR profiles by supplying a target profile ID in the request body, bypassing access controls entirely. Attackers can overwrite sensitive profile data including names and addresses for any user in the system. The vulnerability also allows disabling administrator accounts, effectively enabling a denial-of-service attack against privileged users. The flaw exists in the HrInfoController.java and corresponding HrMapper.xml files in the vhr codebase. No authorization check is performed to verify the requesting user owns the profile being modified. This is classified as a missing authorization (broken access control) vulnerability. The issue has been reported and documented via GitHub issue #349 and VulnCheck advisory.