HCL Connections CVE-2025-15619

Exploitation requires the attacker to hold a valid low-privilege account on the HCL Connections instance (confirmed by PR:L in the CVSS vector) and to trigger a specific, singular scenario described by HCL - the exact nature of that scenario is not disclosed in the CVE description or public advisory. User interaction is required (UI:R), meaning either an action by the attacker or another user must occur to reach the vulnerable code path. What limits exploitation: the attacker must be authenticated (ruling out external unauthenticated threat actors), the impact is read-only and limited (C:L), and the flaw applies to only one specific scenario rather than broad access control failure across the platform. Non-default or specific workflow conditions likely must be met; the precise triggering condition has not been publicly disclosed.

The overall risk is low. The CVSS base score of 3.5 is consistent with the vector's constraints: PR:L confirms an authenticated session is required, UI:R indicates user interaction must occur (reducing automatable exploitation), and C:L with I:N/A:N means the only impact is limited read access to specific data - no modification or denial of service is possible. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no POC or public exploit has been identified. The CPE wildcard version range (all versions) suggests HCL has not yet narrowed the affected scope publicly, or this applies broadly to the product line. The tag 'Authentication Bypass' in the source data is potentially misleading - the CVSS vector (PR:L) explicitly requires low-privilege authentication, so this is not a true authentication bypass in the classic sense but rather a post-authentication access control failure in a narrow scenario. MISSING: No EPSS score was provided; affected version range is unspecified beyond the wildcard CPE.

An authenticated low-privilege user on an HCL Connections deployment triggers a specific interaction or workflow that exposes data outside their authorized scope. By navigating to or initiating the particular scenario where the access control check is absent or bypassed, the attacker reads data they would not normally be permitted to view. No public exploit code exists at time of analysis, so exploitation currently requires attacker knowledge of the specific vulnerable scenario.