An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user lacking Master Operator privileges to retrieve site names, version information, and configuration variables from unprotected endpoints. The flaw arises from missing access controls and inadequate security headers, permitting visibility into internal data that should be restricted to privileged accounts.

HCL Software’s BigFix WebUI is impacted. All deployments using this web interface are potentially vulnerable until an update that restores proper authorization is applied, as no specific version range is defined in the CNA data.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers require an authenticated session with non-privileged credentials and target endpoints that lack proper security headers to bypass privilege checks and access configuration data.