The HCL DominoIQ RAG feature contains a broken access control flaw that causes document‑level restrictions to be ignored when processing AI queries. An attacker who has authenticated credentials can exploit this weakness to retrieve data they should not be permitted to see. The outcome is a loss of confidentiality for sensitive documents and a potential violation of data protection policies. The vulnerability is a classic example of CWE‑862 and can be leveraged without requiring special privileges beyond normal user access to the application.

Any deployment of HCL Software’s DominoIQ that includes the RAG feature is at risk. No specific product versions are listed in the advisory, so all installations using RAG are potentially affected until a vendor patch is applied or the feature is disabled. Administrators should inventory systems that run DominoIQ and verify whether RAG is active.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available and the flaw is not in CISA’s KEV catalog, suggesting a lower observed exploitation probability. An attacker would need authentication and the ability to invoke AI queries; the weakness is exploitable when the application fails to honor access checks, implying a local or network attack with sufficient credentials. The risk is primarily to data confidentiality, with no immediate denial of service or remote code execution. Prompt remediation is advised to prevent unauthorized disclosure.