What is the CVSS score of CVE-2026-21789?

CVE-2026-21789 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

HCL Connections CVE-2026-21789

EUVD-2026-30798 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-18 HCL

GHSA-hx5c-g9jj-chxv

Authentication Bypass Connections

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 20:00 vuln.today

DescriptionCVE.org

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

AnalysisAI

Broken access control in HCL Connections exposes an integrity risk where an authenticated low-privileged user can update data outside their intended authorization scope under specific conditions. The CVSS vector (AV:N/AC:L/PR:L/UI:R) confirms the attack is network-reachable, requires only low-privilege credentials, and involves some form of user interaction. No public exploit code has been identified and HCL Connections is not listed in the CISA KEV catalog, placing this in a moderate-priority remediation tier for most organizations, though environments where data integrity in Connections is business-critical should treat it with elevated urgency.

Technical ContextAI

HCL Connections is an enterprise social collaboration platform developed by HCL Software, commonly deployed in large organizational environments for intranets, file sharing, and team collaboration. The root cause is CWE-863 (Incorrect Authorization), a class of vulnerability where the application performs an authorization check but does so incorrectly - verifying the wrong resource, applying the wrong policy, or skipping the check under edge-case conditions. This is distinct from missing authorization (CWE-862); the check exists but produces a wrong access decision. The CPE string cpe:2.3:a:hclsoftware:connections:*:*:*:*:*:*:*:* uses a wildcard version field, indicating HCL has not publicly scoped the vulnerability to a specific version range in NVD data. The tags 'Authentication Bypass' and 'Connections' from the source align with the broken access control classification.

RemediationAI

Consult the HCL Software advisory KB0129719 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129719 for the official patch and version-specific guidance. No exact fixed version was confirmed in the available intelligence data, so 'Patch available per vendor advisory' is the most accurate characterization - verify the specific remediated build directly with HCL. While awaiting patching, organizations should audit access control configurations within HCL Connections to ensure data modification permissions are tightly scoped to intended roles, and review audit logs for anomalous write activity by low-privileged accounts. Restricting low-privileged user access to sensitive collaboration spaces or data objects as a compensating control may reduce exposure, with the trade-off of reduced platform usability for affected users.