HCL DominoIQ is affected by broken access control

published 2026-05-20 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-31117

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits: 0; none known

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-05-21)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

HCLSoftware DominoIQ

Classification

Weakness

CWE-862 Missing Authorization

References

support.hcl-software.com /csm?id=kb_article&sysparm_article=KB0130932

Sources

CVE List CVE-2026-21836
NVD CVE-2026-21836

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary