EUVD-2026-44906
GHSA-3rj8-qrpc-rrvr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Network-reachable, no credentials needed, but UI:R retained consistent with vendor framing; limited C/I/A impact reflects partial endpoint exposure.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
AnalysisAI
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity verification. The missing access control allows interactions with protected functionality - including read and write operations - from a browser or client that holds no valid session or credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 6.3 medium score and PR:N vector confirm that authentication is not required to reach the affected endpoints.
Technical ContextAI
HCL DFXServer (CPE: cpe:2.3:a:hcl_software:dfxserver:*:*:*:*:*:*:*:*) is an HCL Software application whose API layer fails to enforce authentication on certain endpoints. The root cause is classified as CWE-284 (Improper Access Control), meaning the authorization decision layer is either absent or bypassable for the affected routes. The phrasing 'in another browser' in the vendor description implies that endpoints which are expected to be session-bound can be directly invoked from an unauthenticated browser context - suggesting the application does not validate session tokens or authorization headers server-side before processing requests. This is consistent with a server-side access control gap rather than a purely client-side bypass.
RemediationAI
Apply the patch or configuration fix detailed in HCL's advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782 - the exact fixed version is not independently confirmed from available data, so the advisory is the authoritative source. As an immediate compensating control pending patching, restrict network access to DFXServer API endpoints via perimeter firewall or reverse proxy rules to limit exposure to trusted IP ranges or authenticated VPN users only; this reduces the effective attack surface without altering application behavior. If DFXServer is internet-facing, consider taking the service offline or isolating it behind an authenticated reverse proxy (e.g., requiring HTTP Basic Auth at the gateway layer) until a vendor-released patch can be applied. Note that gateway-level controls do not fix the underlying missing access control and should be treated as temporary mitigations only.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's au
HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attac
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today