---
id: CVE-2026-109849
title: Incorrect privilege assignment issue exists in Hinemos
summary: >-
  Incorrect privilege assignment issue exists in Hinemos. If this vulnerability
  is exploited, an attacker who can access the password change API with specific
  permissions that can be assigned to non-administrative users may change the
  pass…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-266
vendor: NTT DATA INTELLILINK Corporation
product: Hinemos
affected:
  - Hinemos 7.2.0
  - Hinemos >= 7.1.0 <= 7.1.2
  - Hinemos >= 7.0.0 <= 7.0.4
  - Hinemos >= 6.2.0 <= 6.2.2
  - Hinemos >= 6.1.0 <= 6.1.2
  - Hinemos >= 6.0.0 <= 6.0.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T14:26:41.914028Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:06:14.733Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109849'
references:
  - url: 'https://www.hinemos.info/news/hinemos-vulnerability-20261104'
  - url: 'https://jvn.jp/en/jp/JVN46901199/'
tags:
  - cve.org
epss: 0.00182
epssPercentile: 0.07896
ingestedAt: '2026-11-05T22:38:31.503Z'
---

## Overview

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

## Affected

- `Hinemos 7.2.0`
- `Hinemos >= 7.1.0 <= 7.1.2`
- `Hinemos >= 7.0.0 <= 7.0.4`
- `Hinemos >= 6.2.0 <= 6.2.2`
- `Hinemos >= 6.1.0 <= 6.1.2`
- `Hinemos >= 6.0.0 <= 6.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.