Risesoft Digital-Infrastructure CVE-2026-111651

Requires (1) a valid authenticated account on the platform (PR:L - any low-privilege tenant user suffices), (2) a multi-tenant deployment where more than one tenant exists so cross-tenant data is present, and (3) knowledge or guessing of a target tenant's tenantId value, which is then passed to the log-module DownloadController endpoints exportLoginXLS or exportNotLoginXLS. No user interaction, no admin rights, and no non-default configuration are needed beyond standard multi-tenant operation. Limiting factors: exploitation yields only directory PII (confidentiality, no write/modify or service impact), is confined to authenticated users, and has no value in a single-tenant deployment.

CVSS 4.0 base score is 7.1 (HIGH), driven by AV:N/AC:L/PR:L/UI:N with VC:H and no integrity or availability impact - a confidentiality-only cross-tenant data exposure. The vector shows network reachability and low attack complexity with no user interaction, but PR:L confirms the attacker must already hold a valid (low-privilege) account, which meaningfully caps the exploit population to authenticated tenants rather than the open internet. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. No explicit POC flag was supplied, though a public technical writeup (hackmd) and a direct source-code line reference exist, lowering the barrier to weaponization even if no packaged exploit is confirmed. No SSVC decision data was provided. Net assessment: this is a legitimate but moderate-priority issue - real impact is mass PII disclosure across tenants (privacy/compliance exposure), not system compromise; it is not wormable and grants no code execution. Given the niche product footprint and the authentication prerequisite, the realistic threat is targeted abuse by an existing tenant user rather than widespread opportunistic exploitation. Note the tag 'Authentication Bypass' conflicts with the actual defect class (CWE-639 missing authorization requiring authentication) and should not be read as a pre-auth flaw.

A legitimate low-privilege user of one tenant on a shared Risesoft Digital-Infrastructure deployment calls the log-module DownloadController's exportLoginXLS or exportNotLoginXLS endpoint while substituting a different tenant's tenantId. Because the controller performs no ownership/authorization check on the supplied tenantId, the server returns an XLSX containing the victim tenant's full personnel directory - names, login names, organization paths, mobile numbers, and emails. A public technical writeup describing this exact flow exists, though no packaged exploit tool was flagged in the input.