EUVD-2026-42552
GHSA-wq5v-cw79-773m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CORS abuse needs a victim's authenticated browser to visit an attacker page (UI:R); high data exposure (C:H) plus the described privileged actions imply limited integrity impact (I:L), no availability effect.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
AnalysisAI
Sensitive-information disclosure in HCL DevOps Deploy (formerly UrbanCode Deploy) versions 8.1 through 8.1.2.6 and 8.2 through 8.2.1.0 stems from an overly permissive Cross-Origin Resource Sharing (CORS) policy that fails to restrict allowed origins to trusted domains. Because the application accepts or reflects arbitrary origins, an attacker-controlled web page can issue cross-origin credentialed requests against an authenticated user's session to read protected data and invoke privileged actions. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC rates exploitation as none.
Technical ContextAI
The flaw is a CORS misconfiguration classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). CORS is a browser mechanism governing whether a page from one origin may read responses from another; a server signals trust via the Access-Control-Allow-Origin header, and when paired with Access-Control-Allow-Credentials the browser attaches cookies to cross-origin requests. HCL DevOps Deploy - an enterprise continuous-delivery and release-automation platform (the rebranded IBM/HCL UrbanCode Deploy), identified by CPE cpe:2.3:a:hclsoftware:hcl_devops_deploy and exposed through its web UI and REST API - sets this policy too broadly, not limiting the allowed origin to trusted domains. The practical effect is that JavaScript on any attacker origin can read authenticated API responses (deployment configuration, environment and pipeline metadata) that CORS is meant to protect.
RemediationAI
Apply the fix described in HCL's advisory KB0131695 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131695); patch available per vendor advisory, but an exact fixed build number is not stated in the available data, so confirm the target version with HCL and upgrade beyond 8.1.2.6 and 8.2.1.0. As a compensating control until patched, tighten the CORS configuration so Access-Control-Allow-Origin is restricted to an explicit allowlist of trusted internal domains rather than reflecting arbitrary origins, and disable Access-Control-Allow-Credentials for untrusted origins - trade-off: legitimate cross-origin integrations or custom dashboards may break and must be added to the allowlist. Additionally place the DevOps Deploy web/API endpoints behind a reverse proxy or WAF that strips or overrides permissive CORS headers, restrict management-interface access to trusted network segments/VPN, and enforce short session lifetimes to shrink the window in which an authenticated victim's browser can be abused.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today