{"id":"CVE-2026-109849","kind":"vulnerability","aliases":["CVE-2026-109849"],"related":[],"title":"Hinemos: any user with Account-Modify permission can change administrator passwords (ALL_USERS has it by default)","description":"Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.","summary":"In Hinemos, the password-change function let any non-administrator whose role holds the system permission Account-Modify change an administrator's password and gain admin rights. The ALL_USERS role, which every user belongs to, had that permission by default. NTT DATA INTELLILINK fixed it on 2026-11-04 by requiring the caller to be in the ADMINISTRATORS role to change an admin's password.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hinemos-manager","fixed":["7.2.0-2","7.1.2-2","7.0.4-2"],"affected":"7.2.0, >= 7.1.0, <= 7.1.2, >= 7.0.0, <= 7.0.4 (before the -2 release), 6.0.0 - 6.2.2 (unsupported, no fix)","ecosystem":"vendor"}],"ecosystems":[],"tags":["hinemos","other","privilege-escalation","self-hosted"],"not_affected_if":["account-modify-permission-removed","fixed-build-installed","no-non-admin-users"],"how_to_check":"In the Hinemos client, open the Account perspective and check each role (especially ALL_USERS) for the system permission 'Account - Modify', and list which users belong to those roles. Any non-ADMINISTRATORS user holding it can reset admin passwords. Check the manager version: affected are 7.2.0, 7.1.0-7.1.2, 7.0.0-7.0.4 and 6.0.0-6.2.2 unless the fixed build (-2 release) or cumulative patch is installed (e.g. rpm -q hinemos-7.2-manager shows 7.2.0-2).","fix":"Install the vendor's fixed build: OSS users update to hinemos-7.2-manager-7.2.0-2, hinemos-7.1-manager-7.1.2-2 or hinemos-7.0-manager-7.0.4-2 (GitHub releases v7.2.0_2, v7.1.2_2, v7.0.4_2); subscribers apply patch_manager_for7.2.0_20261104.zip, patch_manager_for7.1.2_20261104.zip or patch_manager_for7.0.4_20261104.zip. The update does not change existing role permissions: also remove Account-Modify from ALL_USERS and other roles that do not need it. 6.x (end of standard support) gets no patch; for it, remove the permission.","status":"open","published_at":"2026-11-05T01:17:21+00:00","first_seen_at":"2026-11-05T01:30:51+00:00","triaged_at":"2026-11-05T01:32:07+00:00","updated_at":"2026-11-05T01:33:54+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-05T01:32:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Hinemos: non-admin users can change administrator passwords via API","impact":"high","summary":"Hinemos, a system monitoring and job management product, wrongly assigns privileges so that some non-administrative permissions reach the password change API. An attacker with such an account can change the password of an administrator and take over that admin account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hinemos","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over an administrator account via password change","analyst_note":"Find affected Hinemos versions, the permissions involved, and the vendor advisory with the fixed version; check https://nvd.nist.gov/vuln/detail/CVE-2026-109849 and the JVN/vendor page.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-non-admin-users"],"who_is_affected":"Teams that run Hinemos and grant non-administrative users permissions that can be assigned to them in the product. The sources do not state which Hinemos versions or permission sets are affected, so the exposure cannot be confirmed from them. Installations where no non-admin accounts exist can likely skip it, though the sources do not say this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":4183,"output_tokens":493,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Hinemos versions, the permissions involved, and the vendor advisory with the fixed version; check https://nvd.nist.gov/vuln/detail/CVE-2026-109849 and the JVN/vendor page.","search":"'-04':88B '-109849':21A,24A '-11':87B '-2026':20A,23A '2026':86B 'access':121C 'account':6A,55B 'account-modifi':5A,54B 'admin':64B,102B 'administr':11A,47B,59B,97B,136C,144C 'api':125C 'assign':107C,132C 'attack':118C 'belong':73B 'caller':92B 'chang':10A,41B,57B,100B,124C,139C 'cve':19A,22A 'data':81B 'default':18A,79B 'escal':32B 'everi':71B 'exist':109C 'exploit':116C 'fix':83B 'function':42B 'gain':63B 'hinemo':1A,28B,37B,111C 'hinemos':26A 'hinemos-manager':25A 'hold':50B 'host':35B 'incorrect':105C 'intellilink':82B 'issu':108C 'let':43B 'manager':27A 'may':138C 'modifi':7A,56B 'non':46B,135C 'non-administr':45B,134C 'ntt':80B 'password':12A,40B,61B,104B,123C,141C 'password-chang':39B 'permiss':8A,53B,77B,128C 'privileg':31B,106C 'privilege-escal':30B 'requir':90B 'right':65B 'role':49B,69B,98B 'self':34B 'self-host':33B 'specif':127C 'system':52B 'user':3A,14A,68B,72B,137C,145C 'vulner':114C 'whose':48B","nicknames":[],"mitigations":[],"who_affected":"Teams running the Hinemos manager (7.0-7.2, and unsupported 6.x) where non-administrator accounts exist and belong to a role with the Account-Modify system permission. ALL_USERS had it by default, so by default any logged-in user qualifies. Installs with only administrator accounts, or where Account-Modify was removed from every role non-admins belong to, can skip it. Updating alone does not remove the permission from existing roles.","tier":"B","verified":{"fix":{"at":"2026-11-05T01:33:54Z","by":"analyst","doc":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","run_id":1743},"products":{"at":"2026-11-05T01:33:54Z","by":"analyst","doc":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","run_id":1743},"workarounds":{"at":"2026-11-05T01:33:54Z","by":"analyst","doc":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","run_id":1743},"how_to_check":{"at":"2026-11-05T01:33:54Z","by":"analyst","doc":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","run_id":1743},"who_affected":{"at":"2026-11-05T01:33:54Z","by":"analyst","doc":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","run_id":1743}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hinemosmanager"],"ptokens":["hinemos","manager"],"labels":["high","hinemos","other","privilegeescalation","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T01:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109849","severity":null,"published_at":"2026-11-05T01:17:21+00:00","modified_at":"2026-11-05T01:17:21+00:00","first_seen_at":"2026-11-05T01:30:51+00:00","fetched_at":"2026-11-05T01:30:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109849:1743","url":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","severity":null,"published_at":"2026-11-05T01:33:54+00:00","modified_at":"2026-11-05T01:33:54+00:00","first_seen_at":"2026-11-05T01:33:54+00:00","fetched_at":"2026-11-05T01:33:54+00:00","note":"Read Hinemos vendor notice (2026-11-04) and JVN#46901199. Root cause: any user in a role with system permission Account-Modify could change admin passwords; ALL_USERS had it by default. Fixed builds 7.2.0-2, 7.1.2-2, 7.0.4-2 (OSS RPMs / subscriber cumulative patches); 6.x unpatched, mitigation only. No exploitation or PoC seen.","cites":["https://www.hinemos.info/news/hinemos-vulnerability-20261104","https://jvn.jp/en/jp/JVN46901199/index.html","https://www.hinemos.info/news/hinemos-vulnerability-20261104","https://www.hinemos.info/news/hinemos-vulnerability-20261104"]}],"documents":[{"id":72017,"url":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","title":"Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":72018,"url":"https://jvn.jp/en/jp/JVN46901199/index.html","title":"JVN#46901199 Hinemos vulnerable to incorrect privilege assignment","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":72017,"url":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","title":"Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":72017,"url":"https://www.hinemos.info/news/hinemos-vulnerability-20261104","title":"Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}