CVE-2026-21760

Published: Jul 17, 2026Modified: Jul 17, 2026

4.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.1 / Impact: 2.5

Source: psirt@hcl.com (Secondary)

Description

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.

Related CWEs

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296

Source: psirt@hcl.com

Timeline

No history available yet.