The vulnerability in HCL Aftermarket DPC is a missing functional level access control flaw. This flaw allows an attacker to increase their privileges within the application. As a result, an attacker could gain unauthorized access to the system, potentially compromising the application and gaining the ability to steal or manipulate data. The weakness is categorized as CWE-284.

The affected product is HCL Aftermarket DPC, a cloud-based aftermarket service platform by HCL Tech. No specific version ranges are supplied; the vulnerability was identified for the product as a whole.

The CVSS base score of 8.1 indicates high severity, reflecting the potential for privilege escalation. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The lack of a publicly available exploit does not rule out the possibility of exploitation via web interfaces or API calls, so the attack vector is inferred to be remote, through accepted authentication channels.