--- id: "CVE-2026-109849" kind: "vulnerability" aliases: ["CVE-2026-109849"] title: "Hinemos: any user with Account-Modify permission can change administrator passwords (ALL_USERS has it by default)" severity: "high" cvss: 7.1 epss: null exploited: false status: "open" category: "other" products: [{"name": "hinemos-manager", "fixed": ["7.2.0-2", "7.1.2-2", "7.0.4-2"], "affected": "7.2.0, >= 7.1.0, <= 7.1.2, >= 7.0.0, <= 7.0.4 (before the -2 release), 6.0.0 - 6.2.2 (unsupported, no fix)", "ecosystem": "vendor"}] ecosystems: [] tags: ["hinemos", "other", "privilege-escalation", "self-hosted"] not_affected_if: ["account-modify-permission-removed", "fixed-build-installed", "no-non-admin-users"] published_at: "2026-11-05T01:17:21+00:00" first_seen_at: "2026-11-05T01:30:51+00:00" updated_at: "2026-11-05T01:33:54+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109849", "first_seen_at": "2026-11-05T01:30:51+00:00"}, {"source": "analyst", "url": "https://www.hinemos.info/news/hinemos-vulnerability-20261104", "first_seen_at": "2026-11-05T01:33:54+00:00", "cites": ["https://www.hinemos.info/news/hinemos-vulnerability-20261104", "https://jvn.jp/en/jp/JVN46901199/index.html", "https://www.hinemos.info/news/hinemos-vulnerability-20261104", "https://www.hinemos.info/news/hinemos-vulnerability-20261104"]}] exploit_sources: [] --- # Hinemos: any user with Account-Modify permission can change administrator passwords (ALL_USERS has it by default) In Hinemos, the password-change function let any non-administrator whose role holds the system permission Account-Modify change an administrator's password and gain admin rights. The ALL_USERS role, which every user belongs to, had that permission by default. NTT DATA INTELLILINK fixed it on 2026-11-04 by requiring the caller to be in the ADMINISTRATORS role to change an admin's password. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:hinemos-manager affected 7.2.0, >= 7.1.0, <= 7.1.2, >= 7.0.0, <= 7.0.4 (before the -2 release), 6.0.0 - 6.2.2 (unsupported, no fix) fixed 7.2.0-2, 7.1.2-2, 7.0.4-2 ## How to check In the Hinemos client, open the Account perspective and check each role (especially ALL_USERS) for the system permission 'Account - Modify', and list which users belong to those roles. Any non-ADMINISTRATORS user holding it can reset admin passwords. Check the manager version: affected are 7.2.0, 7.1.0-7.1.2, 7.0.0-7.0.4 and 6.0.0-6.2.2 unless the fixed build (-2 release) or cumulative patch is installed (e.g. rpm -q hinemos-7.2-manager shows 7.2.0-2). ## Fix Install the vendor's fixed build: OSS users update to hinemos-7.2-manager-7.2.0-2, hinemos-7.1-manager-7.1.2-2 or hinemos-7.0-manager-7.0.4-2 (GitHub releases v7.2.0_2, v7.1.2_2, v7.0.4_2); subscribers apply patch_manager_for7.2.0_20261104.zip, patch_manager_for7.1.2_20261104.zip or patch_manager_for7.0.4_20261104.zip. The update does not change existing role permissions: also remove Account-Modify from ALL_USERS and other roles that do not need it. 6.x (end of standard support) gets no patch; for it, remove the permission. ## Timeline - 2026-11-05T01:30:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109849 - 2026-11-05T01:33:54+00:00 analyst https://www.hinemos.info/news/hinemos-vulnerability-20261104 — Read Hinemos vendor notice (2026-11-04) and JVN#46901199. Root cause: any user in a role with system permission Account-Modify could change admin passwords; ALL_USERS had it by default. Fixed builds 7.2.0-2, 7.1.2-2, 7.0.4-2 (OSS RPMs / subscriber cumulative patches); 6.x unpatched, mitigation only. No exploitation or PoC seen. ## Documents - [advisory] Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04) https://www.hinemos.info/news/hinemos-vulnerability-20261104 - [advisory] JVN#46901199 Hinemos vulnerable to incorrect privilege assignment https://jvn.jp/en/jp/JVN46901199/index.html - [fix] Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04) https://www.hinemos.info/news/hinemos-vulnerability-20261104 - [mitigation] Hinemos vendor notice: password change vulnerability and ALL_USERS initial permissions (2026-11-04) https://www.hinemos.info/news/hinemos-vulnerability-20261104 ## From the sources Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_