CVE-2026-21836

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21836", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2026-01-05T16:08:25.000Z", "datePublished": "2026-05-20T13:37:47.679Z", "dateUpdated": "2026-05-21T14:00:30.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-05-20T13:37:47.679Z"}, "title": "HCL DominoIQ is affected by broken access control", "datePublic": "2026-05-20T13:36:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "HCLSoftware", "product": "DominoIQ", "versions": [{"status": "affected", "version": "14.5.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HCL DominoIQ RAG feature is\u00a0affected by\u00a0a Broken Access Control vulnerability. \u00a0Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. \u00a0This could enable an authenticated attacker to view sensitive data.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The HCL DominoIQ RAG feature is&nbsp;affected by&nbsp;a Broken Access Control vulnerability. &nbsp;Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. &nbsp;This could enable an authenticated attacker to view sensitive data.</p>"}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130932"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T14:00:19.829635Z", "id": "CVE-2026-21836", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T14:00:30.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21836", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T14:00:19.829635Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T14:00:26.339Z"}}], "cna": {"title": "HCL DominoIQ is affected by broken access control", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCLSoftware", "product": "DominoIQ", "versions": [{"status": "affected", "version": "14.5.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-05-20T13:36:00.000Z", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130932"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The HCL DominoIQ RAG feature is\u00a0affected by\u00a0a Broken Access Control vulnerability. \u00a0Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. \u00a0This could enable an authenticated attacker to view sensitive data.", "supportingMedia": [{"type": "text/html", "value": "<p>The HCL DominoIQ RAG feature is&nbsp;affected by&nbsp;a Broken Access Control vulnerability. &nbsp;Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. &nbsp;This could enable an authenticated attacker to view sensitive data.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-05-20T13:37:47.679Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21836", "state": "PUBLISHED", "dateUpdated": "2026-05-21T14:00:30.209Z", "dateReserved": "2026-01-05T16:08:25.000Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-05-20T13:37:47.679Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DominoIQ", "vendor": "HCLSoftware", "versions": [{"status": "affected", "version": "14.5.1"}]}], "source": "psirt@hcl.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HCL DominoIQ RAG feature is\u00a0affected by\u00a0a Broken Access Control vulnerability. \u00a0Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. \u00a0This could enable an authenticated attacker to view sensitive data."}, {"lang": "es", "value": "La caracter\u00edstica RAG de HCL DominoIQ est\u00e1 afectada por una vulnerabilidad de control de acceso roto. Bajo ciertas circunstancias, las restricciones de acceso a nivel de documento ser\u00e1n ignoradas al determinar qu\u00e9 datos devolver de una consulta de IA. Esto podr\u00eda permitir a un atacante autenticado ver datos sensibles."}], "id": "CVE-2026-21836", "lastModified": "2026-07-23T12:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@hcl.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21836", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-21T14:00:19.829635Z", "version": "2.0.3"}}]}, "published": "2026-05-20T14:16:36.373", "references": [{"source": "psirt@hcl.com", "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130932"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "psirt@hcl.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "14.5.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DominoIQ", "source": "cna", "vendor": "HCLSoftware"}, "product": "dominoiq", "vendor": "hclsoftware"}], "created": "2026-05-20T15:30:33.489203+00:00", "updated": "2026-05-21T08:19:13.282565+00:00", "vendors": ["hclsoftware", "hclsoftware$PRODUCT$dominoiq"]}