Lenve vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Lenve products: 1 record(s), with severity, exploitation and fixes.

Vhr 1

Exploited only (KEV) →

CVE-2026-110217 Medium · 6.5 CWE-200 Oct 13, 2026

vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the serialized Hr entity for offline cracking and privilege escalation.