CVE-2026-21760CWE-425

CVE-2026-21760

Medium · published July 17, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2026-07-17T21:17Z
Affected products (1)
ProductVersionsFixed in
hcltech/devops_loopall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296 · [email protected]
EPSS history
Timeline
  • 17 JUL 17:06Z
    Unauthorized Access to Admin Functionality via Forced Browsing
    cvelistv5