EUVD-2026-52260
GHSA-725p-7264-fgqq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
PR:L chosen over PR:N because description implies authenticated 'users' bypassing access controls, not fully unauthenticated access; C:L reflects read-only admin view with no write or availability impact.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.
AnalysisAI
Missing granular access control in HCL iControl v3.2.0 exposes administrator-level functionality to unauthorized users over the network. Regular-privilege users can bypass authorization checks to view or access admin-scoped features, resulting in a limited confidentiality impact. No public exploit code exists and no CISA KEV listing is present; however, the 'Authentication Bypass' tag and the network-accessible vector mean the exposure is reachable without physical proximity, though the high attack complexity (AC:H) constrains opportunistic exploitation.
Technical ContextAI
HCL iControl (CPE: cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:*) is an enterprise IT management product from HCL Software. The root cause is CWE-284 (Improper Access Control), a class of flaw where the application fails to enforce role-based or privilege-based boundaries at the function or endpoint level. Rather than checking whether the requesting user holds administrator privileges before serving admin-scoped resources, the application either skips the check entirely or performs it insufficiently, allowing lower-privileged users to reach those code paths. This pattern is distinct from authentication bypass in the strict sense (which would allow unauthenticated access) and is more precisely a broken authorization / missing function-level access control (also aligned with OWASP A01:2021).
RemediationAI
Consult the HCL Software knowledge base article KB0132564 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132564 for the official remediation guidance; no exact patched version number is confirmed in the available intelligence, so organizations should verify the fix version directly with HCL. As a compensating control pending a patch, restrict access to the HCL iControl administrative interface by enforcing network-level controls (firewall rules, VPN gateway, or zero-trust access proxy) to limit who can reach admin endpoints - this reduces the effective attack surface even if the application-level authorization flaw persists. Additionally, review and audit user role assignments within iControl to ensure no regular users hold unnecessary session tokens or cookies that could facilitate the bypass. Enabling detailed access logging on the admin interface will help detect unauthorized access attempts in the interim.
More in Hcl Icontrol
View allHCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error code
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete function
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages tri
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attac
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or appli
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today