EUVD-2026-90813
GHSA-3hwm-64f6-4634
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege iControl user
-
DeliveryManipulate object reference or hit unauthorized endpoint
-
ExploitBypass missing access-control check
-
ExecutionEscalate privileges
-
ImpactModify or delete sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires an authenticated session as a low-privileged user of HCL iControl (PR:L); exploitation is remote over the network (AV:N) with low complexity and no user interaction. The limiting factor is the need for valid low-level credentials/account access to the application - an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag. No special non-default configuration is named in the description; the flaw stems from missing authorization checks / insecure direct object references in the application itself. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) describes a network-exploitable, low-complexity flaw requiring only low-level authentication (PR:L) with no user interaction and full CIA impact. This is consistent with a broken-access-control/IDOR issue that permits privilege escalation. However, the exploitation signals are weak-to-absent: there is no EPSS score, no CISA KEV listing, and no public exploit - so this is 'no public exploit identified at time of analysis.' The 8.8 rating is driven by the broad impact triple (C:H/I:H/A:H) rather than by demonstrated exploitation, so it should be treated as a genuinely high-severity but not actively-exploited issue. One notable inconsistency: the CWE is CWE-250 (Execution with Unnecessary Privileges), whereas the description and tags point to broken access control / IDOR (more aligned with CWE-862 or CWE-639) - this CWE/description mismatch should be verified with the vendor. Because exploitation requires an authenticated foothold (PR:L), realistic risk is highest for deployments exposing accounts to many lower-trust users; a pure external unauthenticated attacker cannot exploit this per the vector despite the 'Authentication Bypass' tag. |
| Exploit ScenarioDerived | A low-privileged authenticated user of HCL iControl manipulates a direct object reference (e.g. an ID parameter) or reaches a function missing an authorization check, and thereby acts on data or operations belonging to other users or higher-privilege roles. Because no user interaction is required and complexity is low, the attacker escalates privileges and modifies or deletes sensitive application records. No public proof-of-concept exploit has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
RemediationAI
Patch available per vendor advisory: HCL documents the fix in knowledge-base article KB0133940 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133940), which should be consulted for the exact fixed build applicable to the installed iControl release, since the supplied CPE wildcard does not name a version. Until the upgrade is applied, the most effective compensating control follows directly from the assessed prerequisite (PR:L): treat every low-privilege iControl account as potentially privileged, and reduce the number of such accounts and their network reachability - place the iControl interface behind access controls so that only trusted networks or VPN users can reach it, since the flaw is AV:N and needs only low-level credentials to trigger. Audit and trim role assignments so that no account holds more rights than its function requires (this directly mitigates the CWE-250 'unnecessary privileges' aspect), and where the product exposes object identifiers, restrict which records each low-privilege role may address. Add server-side logging and alerting on authorization decisions so that requests returning data or performing writes outside a user's expected object scope generate actionable detections, since IDOR abuse tends to appear as legitimate-looking access to unexpected record IDs. Trade-offs to weigh: network restriction can break legitimate remote or delegated administrative workflows, and aggressive role reduction may interrupt business processes that depend on broad read access; schedule these changes with the application owners. Password rotation or MFA on iControl accounts is a useful hardening step but does not fix the underlying missing authorization checks, so it must not be treated as the primary mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a broken access control defect in HCL iControl, an HCL Software product, tracked under CWE-250 (Execution with Unnecessary Privileges) and tagged by the reporter as involving authentication bypass, IDOR, and privilege escalation. CWE-250 describes a condition where a component operates with privileges beyond those needed for the action being performed; in this case the practical manifestation is that server-side authorization checks are missing or insufficient, so a request that carries a valid low-privilege session is executed with higher effective rights than the caller should hold. Insecure direct object references compound the issue: because object identifiers are evidently not validated against the caller's ownership or role, an authenticated low-privileged user can name resources they should not touch and have the operation succeed. The CVSS vector confirms remote network reachability with low attack complexity and no user interaction, and the unchanged scope (S:U) indicates the impact is confined to the iControl security authority. The mismatch between the 'Authentication Bypass' tag and the assessed PR:L vector is important: authentication itself is still enforced, but authorization is not - the bypass is at the permission layer, not the login layer. The affected CPE (cpe:2.3:a:hcl_software:icontrol:*:*:*:*:*:*:*:*) uses a wildcard version, indicating the vendor's advisory does not publicly enumerate a discrete affected version set.
Know when Icontrol gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-priv user (PR:L) exploits IDOR/missing authz remotely with low complexity and no UI; privilege escalation plus data modify/delete yields high C/I/A, scope unchanged.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.
Executive ViewAI
HCL iControl contains a high-severity broken access control flaw (CVE-2026-66246, CVSS 8.8) that allows any authenticated low-privileged user to escalate privileges and modify or delete sensitive application data. Organizations with broadly provisioned or externally reachable iControl low-privilege accounts face the greatest risk because exploitation requires only a valid low-privilege account. Leadership should prioritize reducing exposure and preparing for an eventual vendor patch, as no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict access to HCL iControl, minimize and monitor low-privileged accounts, enforce least privilege and MFA where supported, segment the product from untrusted networks, and audit for anomalous object identifier manipulation; apply vendor patch once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized i
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS fil
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resul
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to r
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to iss
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to ope
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever trigge
Exploit-DB