HCL BigFix Service Management (SM) has a broken access control flaw that permits users to elevate their privileges beyond the intended limits. The weakness, classified as CWE‑532, arises from improper authorization checks that allow an actor to gain elevated rights and potentially access or modify sensitive data and system configuration. The resulting effect includes unauthorized data exposure and system changes that impact the entire platform.

The vulnerability affects HCL BigFix Service Management. No specific version information is provided, so the risk applies to all releases in use until a patch is applied.

The CVSS score of 8.3 indicates a high severity. With no EPSS data and no listing in the KEV catalog, the exact likelihood of exploitation remains uncertain, but the described flaw suggests that attackers who can reach the application may exploit the broken access controls to hijack privileged roles. Because the attack vector is not explicitly documented, we infer it relies on existing authenticated sessions or misconfigured permissions that allow privilege escalation. Until a vendor fix is deployed, the best mitigation is to block or monitor privileged endpoints.