Information Disclosure in Lenve vhr Product by Lenve

CVE-2026-110217

What is CVE-2026-110217?

The Lenve vhr product has a vulnerability that permits authenticated users to expose sensitive information, specifically BCrypt password hashes. This weakness arises from the ability of low-privileged operators to access data from the GET /chat/hrs endpoint, potentially leading to unauthorized password retrieval, including those of administrators. By exploiting this flaw, attackers can collect crucial information such as password hashes, phone numbers, and addresses, which could facilitate offline cracking techniques and privilege escalation.

References