CVE-2025-31961

Published: Aug 15, 2025Modified: Jun 17, 2026

4.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.1 / Impact: 2.5

Source: NVD

Description

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

Affected (11)

Products: Hcltech: Connections

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Hcltech Connections	Version 8.0
Hcltech Connections	Version 8.0 cumulative_release10
Hcltech Connections	Version 8.0 cumulative_release1
Hcltech Connections	Version 8.0 cumulative_release2
Hcltech Connections	Version 8.0 cumulative_release3
Hcltech Connections	Version 8.0 cumulative_release4
Hcltech Connections	Version 8.0 cumulative_release5
Hcltech Connections	Version 8.0 cumulative_release6
Hcltech Connections	Version 8.0 cumulative_release7
Hcltech Connections	Version 8.0 cumulative_release8
Hcltech Connections	Version 8.0 cumulative_release9

Related CWEs

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123268

Source: psirt@hcl.com

Vendor Advisory

Timeline

No history available yet.