HCL DevOps Loop CVE-2026-21760

Exploitation requires the attacker to hold a valid low-privileged authenticated account within HCL DevOps Loop - unauthenticated external attackers cannot exploit this directly. The attacker must know or be able to enumerate the specific URL paths of administrative endpoints, which are not surfaced in the standard user interface. The CVSS vector includes UI:R, which is unusual for forced browsing and may indicate a specific workflow trigger is required; this should be verified against the vendor advisory. Limiting factors include: mandatory authentication (PR:L), requirement to discover undocumented admin URLs, and constrained impact scope (no full compromise, no availability impact). Organizations with strict network-layer controls preventing general users from reaching admin application paths would significantly reduce exploitability.

The provided CVSS 3.1 score of 4.6 (Medium) reflects a constrained but real risk: PR:L requires the attacker to hold at least a low-privileged authenticated account, narrowing the threat surface to insider threats or compromised user credentials. Scope is unchanged (S:U) and impacts are limited to Low confidentiality and Low integrity with no availability impact, suggesting partial data exposure and limited ability to modify admin settings rather than full system compromise. The UI:R component is atypical for a forced browsing vulnerability, which ordinarily requires no user interaction - this metric should be verified against the vendor advisory at KB0132296. No EPSS score was provided, no KEV listing exists, and no public POC has been identified, collectively indicating this is not a currently prioritized exploitation target. Real-world risk is moderate for organizations where malicious insiders or attackers who have already obtained low-privileged credentials could escalate access to administrative functionality.

An authenticated low-privileged HCL DevOps Loop user who discovers or enumerates administrative endpoint URLs - through documentation, JavaScript source review, or path guessing - navigates directly to those URLs without being redirected or blocked. The application serves the administrative response without verifying the user's role, granting unauthorized visibility into or control over admin-level configuration or data. No public POC has been identified, but the low attack complexity means exploitation requires no specialized tooling beyond a web browser.