Bigfix Webui Cmep CVEs and Security Vulnerabilities

CVE-2025-15633

HCL BigFix WebUI is affected by an improper authorization vulnerability

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Webui Bigfix Webui Api Bigfix Webui Application Administration and 19 more

CVE-2025-15634

HCL BigFix WebUI is affected by a missing authorization vulnerability

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.