HCL Traveler CVE-2026-56547

Exploitation requires an active, authenticated Traveler session (PR:L confirmed by CVSS vector) and deliberate interaction with the Apple profile generation page (UI:R confirmed by CVSS vector). The attacker must supply arbitrary Logon Name and Mail Address strings where the application expects the authenticated user's own values. Critically, the generated profile is described by the vendor as non-functional without additional information not provided by the profile alone, and can only be installed on the attacker's own device - exploitation cannot extend to compromising third-party accounts or devices. Limiting factors: authentication required; user interaction with the generation flow required; resulting artifact is self-targeting only; no scope change (S:U); non-default attack in that the user must intentionally submit someone else's identity values rather than their own.

The vendor-assigned CVSS 3.1 score of 3.5 (Low) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L reflects the constrained impact accurately. Attack prerequisites include valid authentication (PR:L) and user interaction with the profile generation page (UI:R), immediately limiting the exposure surface. The A:L impact designation is puzzling given the description - the primary effect is embedding incorrect identity data into the profile (an integrity concern), not an availability degradation; this metric choice by the vendor is inconsistent with the described behavior and should be verified. EPSS data is absent from available intelligence, but given the self-targeting constraint - the resulting profile cannot be weaponized against third-party accounts without additional credentials - real-world exploitation risk is negligible. The vulnerability is not in CISA KEV, no POC has been published, and the tags cite 'Information Disclosure' despite the CVSS C:N metric, suggesting the tagging may overstate the confidentiality dimension. Overall, this is a low-priority finding appropriate for scheduled patch cycles rather than emergency response.

An authenticated Traveler user navigates to the Apple profile generation page and deliberately submits a different user's Logon Name and Mail Address instead of their own. Traveler generates and returns an Apple configuration profile embedding those unverified values. The attacker can install this profile only on their own Apple device; without the target account's credentials, the profile does not grant access to the target user's Domino data. No public exploit code exists for this scenario.