CVE-2026-109849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109849", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-10-23T00:43:07.402Z", "datePublished": "2026-11-05T00:40:01.301Z", "dateUpdated": "2026-11-05T19:06:14.733Z"}, "containers": {"cna": {"affected": [{"vendor": "NTT DATA INTELLILINK Corporation", "product": "Hinemos", "defaultStatus": "unknown", "versions": [{"version": "7.2.0", "status": "affected"}, {"version": "7.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "7.1.2"}, {"version": "7.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "7.0.4"}, {"version": "6.2.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "6.2.2"}, {"version": "6.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "6.1.2"}, {"version": "6.0.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "6.0.3"}]}], "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user."}], "problemTypes": [{"descriptions": [{"description": "Incorrect privilege assignment", "lang": "en-US", "cweId": "CWE-266", "type": "CWE"}]}], "references": [{"url": "https://www.hinemos.info/news/hinemos-vulnerability-20261104"}, {"url": "https://jvn.jp/en/jp/JVN46901199/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-11-05T00:40:01.301Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T14:26:41.914028Z", "id": "CVE-2026-109849", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:06:14.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T14:26:41.914028Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:06:04.519Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "NTT DATA INTELLILINK Corporation", "product": "Hinemos", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.2"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.4"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.2"}, {"status": "affected", "version": "6.1.0", "versionType": "semver", "lessThanOrEqual": "6.1.2"}, {"status": "affected", "version": "6.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.3"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.hinemos.info/news/hinemos-vulnerability-20261104"}, {"url": "https://jvn.jp/en/jp/JVN46901199/"}], "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect privilege assignment"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-11-05T00:40:01.301Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109849", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:06:14.733Z", "dateReserved": "2026-10-23T00:43:07.402Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-11-05T00:40:01.301Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Hinemos", "vendor": "NTT DATA INTELLILINK Corporation", "versions": [{"status": "affected", "version": "7.2.0"}, {"lessThanOrEqual": "7.1.2", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.4", "status": "affected", "version": "7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.2", "status": "affected", "version": "6.2.0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.2", "status": "affected", "version": "6.1.0", "versionType": "semver"}, {"lessThanOrEqual": "6.0.3", "status": "affected", "version": "6.0.0", "versionType": "semver"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user."}], "id": "CVE-2026-109849", "lastModified": "2026-11-06T20:36:20.133", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109849", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T14:26:41.914028Z", "version": "2.0.3"}}]}, "published": "2026-11-05T01:17:21.490", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN46901199/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.hinemos.info/news/hinemos-vulnerability-20261104"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{"bugzilla": {"description": "hinemos: Hinemos: Privilege escalation via password change API", "id": "2567621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567621"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-266", "details": ["Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.", "A flaw was found in Hinemos. Due to an incorrect privilege assignment issue, an authenticated user with specific non-administrative permissions can access the password change application programming interface (API) to modify an administrative user's password. This flaw can allow an attacker to compromise administrative accounts, leading to privilege escalation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-109849", "public_date": "2026-11-05T00:40:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109849\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109849\nhttps://jvn.jp/en/jp/JVN46901199/\nhttps://www.hinemos.info/news/hinemos-vulnerability-20261104"], "statement": "This vulnerability is rated as having a Moderate impact because exploitation requires an authenticated attacker to already possess specific user permissions rather than allowing unauthenticated access. Furthermore, Hinemos is third-party software not included or supported in Red Hat Enterprise Linux or other Red Hat product lines. Consequently, default Red Hat environments are not directly affected by this issue.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.0,7.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.2.0,6.2.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,6.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.0.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Hinemos", "source": "cna", "vendor": "NTT DATA INTELLILINK Corporation"}, "product": "hinemos", "vendor": "ntt_data_intellilink_corporation"}], "created": "2026-11-05T01:30:08.942527+00:00", "title": "Privilege Escalation via Password Change API in Hinemos", "updated": "2026-11-06T21:27:13.768531+00:00", "vendors": ["ntt_data_intellilink_corporation", "ntt_data_intellilink_corporation$PRODUCT$hinemos"]}