CVE-2026-21766

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El portlet de inicio de sesión predeterminado en HCL Digital Experience y Digital Experience Compose protege insuficientemente las credenciales. Bajo ciertos casos de uso muy específicos y configuraciones específicas, la información sensible puede escribirse en los registros del servidor web. Esto solo afecta a las aplicaciones que utilizan el portlet de inicio de sesión predeterminado.

Information

Published : 2026-08-05 20:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-21766

Mitre link : CVE-2026-21766

CVE.ORG link : CVE-2026-21766

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-21766", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21766", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:12:38.947645Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.0}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "HCL Digital Experience and Digital Experience Compose", "versions": [{"status": "affected", "version": "9.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T20:17:08.627", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659", "source": "psirt@hcl.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. \u00a0Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.\u00a0 This only affects applications using the default login portlet."}, {"lang": "es", "value": "El portlet de inicio de sesi\u00f3n predeterminado en HCL Digital Experience y Digital Experience Compose protege insuficientemente las credenciales. Bajo ciertos casos de uso muy espec\u00edficos y configuraciones espec\u00edficas, la informaci\u00f3n sensible puede escribirse en los registros del servidor web. Esto solo afecta a las aplicaciones que utilizan el portlet de inicio de sesi\u00f3n predeterminado."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "psirt@hcl.com"}