EUVD-2026-49182
GHSA-cg5p-v66j-3vjx
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Low-severity information disclosure in HCL Connections allows authenticated users with low privileges to obtain sensitive information they are not entitled to, caused by improper error handling. Exploitation requires user interaction and does not affect integrity or availability. No active exploitation or public exploit code has been reported.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Connections gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (HCL) · only source for this CVE.
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Connections
View allHCL Connections 6.5 is vulnerable to possible information leakage. Rated medium severity (CVSS 5.5), this vulnerability
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplie
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before C
IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recu
IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sens
HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sen
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized use
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to exe
Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
Exploit-DB