CVE-2026-109849
Description
A flaw was found in Hinemos. Due to an incorrect privilege assignment issue, an authenticated user with specific non-administrative permissions can access the password change application programming interface (API) to modify an administrative user's password. This flaw can allow an attacker to compromise administrative accounts, leading to privilege escalation.
Statement
This vulnerability is rated as having a Moderate impact because exploitation requires an authenticated attacker to already possess specific user permissions rather than allowing unauthenticated access. Furthermore, Hinemos is third-party software not included or supported in Red Hat Enterprise Linux or other Red Hat product lines. Consequently, default Red Hat environments are not directly affected by this issue.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
