What is the CVSS score of CVE-2025-15619?

CVE-2025-15619 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

HCL Connections CVE-2025-15619

EUVD-2025-210310 LOW

Improper Access Control (CWE-284)

2026-06-23 HCL

GHSA-p83g-vrrg-rq2w

Authentication Bypass Connections

3.5

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.5 LOW

Authenticated low-privilege user required (PR:L), user interaction needed to trigger scenario (UI:R), only limited confidentiality disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 16:02 vuln.today

DescriptionCVE.org

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

AnalysisAI

HCL Connections exposes a broken access control flaw that permits a low-privileged, authenticated user to view data they should not be authorized to access, but only under one specific scenario. Classified under CWE-284 (Improper Access Control), the vulnerability requires network access, low privileges, and user interaction, limiting its real-world exploitation surface considerably. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 3.5 reflects a genuinely low-severity finding.

Technical ContextAI

HCL Connections (CPE: cpe:2.3:a:hclsoftware:connections:*:*:*:*:*:*:*:*) is an enterprise social collaboration platform developed by HCL Software, used for internal networking, file sharing, and team collaboration in corporate environments. The root cause class is CWE-284 (Improper Access Control), which describes a failure to correctly enforce authorization checks on a resource. In this instance, a specific code path or scenario fails to verify that the requesting user has the appropriate permission to view certain data, allowing unauthorized data disclosure. The AV:N/AC:L/PR:L/UI:R CVSS vector indicates the flaw is reachable over the network but requires the attacker to be authenticated (low privileges) and that some form of user interaction is involved in triggering the condition.

RemediationAI

Consult HCL's official advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130163 (KB0130163) for the patched release version; a vendor-released patch is referenced but the exact fix version is not independently confirmed from available data. If a patch cannot be applied immediately, consider restricting access to HCL Connections to trusted internal networks or VPN-only access, which limits the attack surface given the AV:N vector. Audit user roles and permissions within HCL Connections to ensure least-privilege principles are enforced, as the flaw is constrained to authenticated low-privilege users. Monitoring access logs for anomalous data retrieval by non-administrative accounts may help detect exploitation attempts in the narrow scenario described.