Privilege Escalation Vulnerability in Hinemos by Hinemos Inc.
CVE-2026-109849

7.1HIGH

Key Information:

Vendor

Ntt Data Intellilink Corporation

Status
Hinemos
Vendor
CVE Published:
5 November 2026

What is CVE-2026-109849?

A privilege escalation vulnerability has been identified in Hinemos, where improper privilege assignments exist within the password change API. This issue could allow an attacker with specific permissions, typically granted to non-administrative users, to change the password of an administrative user. If exploited, this vulnerability can lead to unauthorized access and control over the administrative functionalities of the Hinemos system.

Affected Version(s)

Hinemos 7.2.0

Hinemos 7.1.0 <= 7.1.2

Hinemos 7.0.0 <= 7.0.4

References

https://www.hinemos.info/news/hinemos-vulnerability-20261104
https://jvn.jp/en/jp/JVN46901199/

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.