Missing Authorization Vulnerability in HCL BigFix WebUI

CVE-2025-15634

What is CVE-2025-15634?

An authenticated user is able to access sensitive environmental details without the appropriate permissions due to a missing authorization check in the HCL BigFix WebUI. By utilizing direct URLs, users can inadvertently retrieve data that should be restricted, posing a risk to the confidentiality of the system's information resources. This vulnerability emphasizes the importance of implementing robust access controls to safeguard sensitive data from unauthorized access.

References