CVE-2026-111651CWE-639

CVE-2026-111651

Medium · published October 16, 2026

CVSS v3.1

6.5

EPSS

Percentile

22.0

In the wild

Unconfirmed

What it is

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00304 · 22.0th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-10-16T22:17Z

References (4)

https://github.com/risesoft-y9/Digital-Infrastructure · [email protected]https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java#L47-L82 · [email protected]https://hackmd.io/@hieuPenguinnn/digital-infrastructure-log-download-cross-tenant-person-export · [email protected]https://www.vulncheck.com/advisories/risesoft-digital-infrastructure-through-9.6.11-cross-tenant-data-exposure-via-downloadcontroller · [email protected]

EPSS history

Timeline

18 OCT 03:27Z
EPSS moved — → 0%
epss
16 OCT 17:39Z
Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
cvelistv5
16 OCT 17:39Z
Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
cvelistv5