HCL AION lacks a proper Cross-Origin-Resource-Policy header or serves one that is insecure, which allows resources that should be protected from other origins to be fetched by those origins. This can lead to cross‑origin data leakage where confidential or sensitive information becomes available to unintended parties and may trigger unexpected behavior in the application.

The affected system is HCL Software’s HCL AION product. No specific version information is provided, so all installations may potentially be vulnerable.

The CVSS score of 4.8 indicates a moderate risk; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attack vector would involve an adversary hosting a site that requests the vulnerable resources, thereby bypassing same‑origin restrictions that should have been enforced by a CORP header. Although this does not allow code execution or full system compromise, it can enable confidential data exposure under the conditions outlined.