CVE-2026-21836

{"id": "CVE-2026-21836", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21836", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T14:00:19.829635Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "DominoIQ", "versions": [{"status": "affected", "version": "14.5.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T14:16:36.373", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130932", "source": "psirt@hcl.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The HCL DominoIQ RAG feature is\u00a0affected by\u00a0a Broken Access Control vulnerability. \u00a0Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. \u00a0This could enable an authenticated attacker to view sensitive data."}, {"lang": "es", "value": "La caracter\u00edstica RAG de HCL DominoIQ est\u00e1 afectada por una vulnerabilidad de control de acceso roto. Bajo ciertas circunstancias, las restricciones de acceso a nivel de documento ser\u00e1n ignoradas al determinar qu\u00e9 datos devolver de una consulta de IA. Esto podr\u00eda permitir a un atacante autenticado ver datos sensibles."}], "lastModified": "2026-07-23T12:10:00.110", "sourceIdentifier": "psirt@hcl.com"}