{"affected":[{"defaultStatus":"unknown","product":"Hinemos","source":"CNA: jpcert","vendor":"NTT DATA INTELLILINK Corporation","versions":[{"status":"affected","version":"7.2.0"},{"lessThanOrEqual":"7.1.2","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThanOrEqual":"7.0.4","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2.2","status":"affected","version":"6.2.0","versionType":"semver"},{"lessThanOrEqual":"6.1.2","status":"affected","version":"6.1.0","versionType":"semver"},{"lessThanOrEqual":"6.0.3","status":"affected","version":"6.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-109849","cwes":["CWE-266"],"description":"Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: jpcert","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.0"},{"score":7.1,"severity":"high","source":"CNA: jpcert","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793839201301,"publishedAt":1793839201301,"references":[{"source":"CNA: jpcert","tags":[],"url":"https://www.hinemos.info/news/hinemos-vulnerability-20261104"},{"source":"CNA: jpcert","tags":[],"url":"https://jvn.jp/en/jp/JVN46901199/"}],"remediation":[],"revision":"d57a5e5c2d9148553f85728dc358e49a369ee88eadd31c021a698bdfbf34c0c0","sources":[{"modifiedAt":1793839201301,"name":"CNA: jpcert","retrievedAt":1793840899597,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109849"}],"ssvc":null,"status":"published","title":"CVE-2026-109849","updatedAt":1793840899597}