EUVD-2026-45230
GHSA-5ffw-6qxc-pqrw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Forced browsing requires no user interaction, so UI:N is more accurate; all other metrics match the described network-accessible, low-privilege, limited-impact profile.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
1DescriptionCVE.org
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
AnalysisAI
Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administrative endpoints by directly navigating to protected URLs without proper authorization enforcement. The application fails to validate that the requesting user holds sufficient privileges before serving administrative responses, enabling unauthorized access to admin functionality over the network. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-425 (Direct Request / Forced Browsing) describes a failure to enforce server-side authorization on protected application endpoints. In HCL DevOps Loop, the application likely presents administrative URLs that are not linked in the standard user interface but remain reachable if a user constructs or discovers the URL path directly. The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates a web-hosted application accessible over the network. Proper remediation requires enforcing role-based access control checks on every request to an admin-designated endpoint, not merely hiding those URLs from unprivileged UI navigation flows.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296 for the patched release version and upgrade instructions. No exact fix version was present in the provided intelligence data, so the patch version is not independently confirmed here - reference the KB article directly. As a compensating control prior to patching, restrict network access to administrative endpoints through web application firewall rules or reverse proxy path-based ACLs targeting admin URL prefixes, noting this adds operational overhead and may block legitimate admin workflows. Additionally, audit authentication and authorization logs for unexpected access to admin endpoints to detect exploitation attempts.
More in Devops Loop
View allSession hijacking in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 allows an authenticated user to impersonate a
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacki
Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, e
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today