CVE-2025-15633CWE-863

HCL BigFix WebUI is affected by an improper authorization vulnerability

Medium · published May 9, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-09T04:58Z
EPSS history
Timeline
  • 09 MAY 04:58Z
    HCL BigFix WebUI is affected by an improper authorization vulnerability
    cvelistv5