VULNERABILITY INTELLIGENCE

CVE-2025-15633

CVSS score6.5 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-05-09
Last modified2026-07-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Weakness classification

  • psirt@hcl.com: CWE-863

Primary references