HCL iControl EUVD-2026-52260

The specific bypass condition is missing granular access control enforcement on administrator-level endpoints or functionalities within HCL iControl v3.2.0; the application does not verify that the requesting user holds an administrator role before serving those resources. Based on the CVSS vector (PR:N per the provided score), the flaw may be reachable without authentication, but the description's use of 'users' and the AC:H metric suggest that either a low-privilege authenticated session or a specific non-default request path is required - this ambiguity is not resolved by the available data. What limits exploitation: the high attack complexity (AC:H) implies preconditions such as specific endpoint knowledge or session state; the confidentiality impact is read-only (C:L) with no write or denial-of-service capability; and the affected version is a single confirmed release (v3.2.0). No special platform or OS is indicated. Authentication requirements are not fully confirmed from available data due to the PR:N versus 'users' language conflict.

The NVD-assigned CVSS 3.1 base score of 3.7 (Low) is consistent with a network-accessible flaw (AV:N) that requires high complexity (AC:H) to trigger and yields only limited confidentiality exposure (C:L) with no integrity or availability impact. The AC:H metric is the primary risk dampener - it implies that exploitation requires specific, non-trivial preconditions beyond simply sending a crafted request. The 'Authentication Bypass' tag in the intelligence data creates a tension with the description's use of the word 'users,' which more naturally implies an authenticated low-privilege actor bypassing access controls rather than a fully unauthenticated external party; this ambiguity should be resolved with the vendor. No KEV listing and no public POC code have been identified, and no EPSS data is available in the provided intelligence. The overall real-world priority is low to medium: the confidentiality impact is bounded (view-only of admin functions), the product footprint is niche, and the AC:H constraint limits mass exploitation. Organizations running HCL iControl v3.2.0 in internet-exposed configurations face the highest residual risk.

An authenticated low-privilege user with a valid account in HCL iControl v3.2.0 crafts a direct HTTP request to an admin-scoped endpoint or function - bypassing the application's missing authorization check - and retrieves configuration data or user lists accessible only to administrators. The AC:H constraint suggests that exploitation may require specific timing, session state, or endpoint knowledge not immediately obvious, but no public proof-of-concept code has been identified at time of analysis that would lower that bar.