CVE-2026-109849

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

7.1 HIGHEPSS 0.18%Not in KEVNVD: Deferred

Last updated: 2026-11-06 20:36 UTC

OverviewCVSS details

7.1HIGHCVSS 4.0

Score source: jpcert (CNA)
NVD status: Deferred
Published: Nov 5, 2026
Assigner: jpcert

Affected

Hinemos (NTT DATA INTELLILINK Corporation)

Versions: 7.2.0 · 7.1.0 through 7.1.2

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.18%chance of exploitation in 30 days

Higher than 7.86% of CVEs

CVSS 4.0 · jpcert (CNA)

7.1High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality impact: None
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.0 · jpcert (CNA)

6.5Medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: High
Availability impact: None

NVD status: Deferred

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.1	HIGH	4.0jpcert (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
6.5	MEDIUM	3.0jpcert (CNA)	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CVE ID: CVE-2026-109849
Status: Deferred
Assigner (CNA): jpcert
Published: Nov 5, 2026
Last modified: 2026-11-06 20:36 UTC
Weaknesses: CWE-266 · Incorrect privilege assignment

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:20 UTC.