CVE-2025-15634
Medium
Description
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
SeverityMedium
CVSS4.3
Exploit probability—
ProductHcltech Bigfix Webui Api
PublishedMay 9, 2026
First seenMay 9, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- hcltech bigfix_webui_api33 or later
- hcltech bigfix_webui_application_administration40 or later
- hcltech bigfix_webui_cmep22 or later
- hcltech bigfix_webui_common101 or later
- hcltech bigfix_webui_content_app28 or later
- hcltech bigfix_webui_custom50 or later
- hcltech bigfix_webui_data_sync37 or later
- hcltech bigfix_webui_extensions14 or later
- hcltech bigfix_webui_framework35 or later
- hcltech bigfix_webui_insights32 or later
- hcltech bigfix_webui_ivr23 or later
- hcltech bigfix_webui_mdm29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hcltech bigfix_webui_api | v < 33 | 33 |
| hcltech bigfix_webui_application_administration | v < 40 | 40 |
| hcltech bigfix_webui_cmep | v < 22 | 22 |
| hcltech bigfix_webui_common | v < 101 | 101 |
| hcltech bigfix_webui_content_app | v < 28 | 28 |
| hcltech bigfix_webui_custom | v < 50 | 50 |
| hcltech bigfix_webui_data_sync | v < 37 | 37 |
| hcltech bigfix_webui_extensions | v < 14 | 14 |
| hcltech bigfix_webui_framework | v < 35 | 35 |
| hcltech bigfix_webui_insights | v < 32 | 32 |
| hcltech bigfix_webui_ivr | v < 23 | 23 |
| hcltech bigfix_webui_mdm | v < 29 | 29 |
| hcltech bigfix_webui_patch | v < 54 | 54 |
| hcltech bigfix_webui_patch_policies | v < 51 | 51 |
| hcltech bigfix_webui_permissions_and_preferences | v < 27 | 27 |
| hcltech bigfix_webui_profile_management | v < 33 | 33 |
| hcltech bigfix_webui_query | v < 45 | 45 |
| hcltech bigfix_webui_reports | v < 24 | 24 |
| hcltech bigfix_webui_scm | v < 20 | 20 |
| hcltech bigfix_webui_software_distribution | v < 54 | 54 |
| hcltech bigfix_webui_take_action | v < 37 | 37 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.