EUVD-2026-68615
GHSA-xq3v-phjg-8r8x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible application with only partial data exposure; AC:H and UI:R reflect constrained attack prerequisites; no integrity or availability impact applies.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.
AnalysisAI
HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required (UI:R per CVSS vector) - a victim user must perform an action as part of the attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The aggregate risk signal for this vulnerability is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130164 for the authoritative patched version and upgrade instructions; no specific fix version is identifiable from the provided input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Connections
View allHCL Connections 6.5 is vulnerable to possible information leakage. Rated medium severity (CVSS 5.5), this vulnerability
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplie
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before C
IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 does not properly detect recu
IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sens
HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized use
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace
HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to exe
Cross-site request forgery (CSRF) vulnerability in the Profiles component in IBM Connections through 3.0.1.1 CR3 allows
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in
IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vul
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today