A missing authorization vulnerability exists in the vhr HR management application through commit 03abbd3. The PUT /hr/pass endpoint fails to verify that the account ID supplied in the request belongs to the authenticated caller. An authenticated attacker can exploit this flaw to change the password of any arbitrary account by providing the target account's ID and current password in the request body. This represents a broken access control issue that could allow privilege escalation or account takeover. The vulnerability affects the HrService and HrInfoController components of the vhr application. Exploitation requires authentication but no elevated privileges. The issue has been reported via GitHub issues and documented by VulnCheck.
