The vulnerability is a broken access control flaw that permits an unauthorized user to update protected data. It is classified as CWE‑863. The description explicitly states that the flaw may allow a user without proper authorization to modify data in certain scenarios, potentially impacting data integrity and confidentiality. The impact is limited to the scope of data that can be updated via the affected interface, and does not, as described, allow arbitrary code execution or system compromise.

The vulnerable product is HCLSoftware Connections. No specific versions are listed in the CNA data, so all released instances of the platform may be affected until a patch is deployed.

The CVSS score of 4.6 places the flaw in the moderate range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that the likelihood of widespread exploitation is low at present. However, because the weakness permits privilege escalation to data modification, any publicly exposed or poorly segmented Connections deployment could be targeted. The attack vector is likely via the web interface or API where update operations are performed, and would require an attacker to reach the component that processes update requests.