EUVD-2026-49183
GHSA-2ggm-9493-rh4g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Requires low privileges and user interaction; no integrity/availability impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.
AnalysisAI
Information disclosure vulnerability in HCL Connections 8.0 allows an authenticated low-privilege user to access sensitive data through a vulnerable endpoint, requiring user interaction. No public exploit or active exploitation has been identified, and the overall risk is low.
Technical ContextAI
HCL Connections is an enterprise social business platform. The vulnerability resides in a specific endpoint (likely a web interface or API) that fails to properly restrict sensitive information, aligning with CWE-213 (Exposure of Sensitive Information Due to Not Using Encryption). While the CWE suggests encryption issues, the CVSS vector indicates a broader information leak requiring user interaction.
RemediationAI
Apply the official patch provided by HCL in support article KB0132507 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132507). Upgrade to the patched version of HCL Connections 8.0. As a workaround, restrict access to the vulnerable endpoint through network segmentation or additional authentication controls, though the exact endpoint is not publicly specified.
More in Connections
View allHCL Connections 6.5 is vulnerable to possible information leakage. Rated medium severity (CVSS 5.5), this vulnerability
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplie
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before C
IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recu
IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sens
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized use
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to exe
Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vul
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today