CVE-2025-15633An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables)…
Updated under an hour ago ()
Does this affect you?
It affects hcltech bigfix_webui_api and 20 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
- CVSS
- 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jul 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
hcltech bigfix_webui_api hcltech:bigfix_webui_api | before 33 | NVD |
hcltech bigfix_webui_application_administration hcltech:bigfix_webui_application_administration | before 40 | NVD |
hcltech bigfix_webui_cmep hcltech:bigfix_webui_cmep | before 22 | NVD |
hcltech bigfix_webui_common hcltech:bigfix_webui_common | before 101 | NVD |
hcltech bigfix_webui_content_app hcltech:bigfix_webui_content_app | before 28 | NVD |
hcltech bigfix_webui_custom hcltech:bigfix_webui_custom | before 50 | NVD |
hcltech bigfix_webui_data_sync hcltech:bigfix_webui_data_sync | before 37 | NVD |
hcltech bigfix_webui_extensions hcltech:bigfix_webui_extensions | before 14 | NVD |
hcltech bigfix_webui_framework hcltech:bigfix_webui_framework | before 35 | NVD |
hcltech bigfix_webui_insights hcltech:bigfix_webui_insights | before 32 | NVD |
hcltech bigfix_webui_ivr hcltech:bigfix_webui_ivr | before 23 | NVD |
hcltech bigfix_webui_mdm hcltech:bigfix_webui_mdm | before 29 | NVD |
hcltech bigfix_webui_patch hcltech:bigfix_webui_patch | before 54 | NVD |
hcltech bigfix_webui_patch_policies hcltech:bigfix_webui_patch_policies | before 51 | NVD |
hcltech bigfix_webui_permissions_and_preferences hcltech:bigfix_webui_permissions_and_preferences | before 27 | NVD |
hcltech bigfix_webui_profile_management hcltech:bigfix_webui_profile_management | before 33 | NVD |
hcltech bigfix_webui_query hcltech:bigfix_webui_query | before 45 | NVD |
hcltech bigfix_webui_reports hcltech:bigfix_webui_reports | before 24 | NVD |
hcltech bigfix_webui_scm hcltech:bigfix_webui_scm | before 20 | NVD |
hcltech bigfix_webui_software_distribution hcltech:bigfix_webui_software_distribution | before 54 | NVD |
hcltech bigfix_webui_take_action hcltech:bigfix_webui_take_action | before 37 | NVD |
References
- https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.