A missing authorization check in HCL BigFix WebUI lets an authenticated user without the correct permissions view sensitive environmental details via a direct URL to the restricted page. This flaw, classified as CWE‑862, results in unauthorized disclosure of confidential data and could facilitate further reconnaissance or credential misuse by an attacker who has an account but insufficient privileges. The impact is a breach of confidentiality for the exposed environment information, but it does not directly allow remote code execution or denial of service.

The vulnerability affects HCL Software’s BigFix WebUI. No specific product versions are listed by the CNA, so any installation of BigFix WebUI that predates the public fix may be at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known active exploitation. Exploitation requires the attacker to possess a valid user account, but it does not rely on unauthenticated access. The attack path is straightforward: an authenticated user simply navigates to the restricted URL, and the missing authorization check allows the data to be displayed. Because the flaw does not involve remote code execution or privilege escalation, the likelihood of widespread exploitation remains low, though illicit disclosure of environment data is possible.