CVE-2025-15633 MEDIUM

CVE-2025-15633: HCL BigFix WebUI is affected by an improper authorization vulnerability

Vendor Hclsoftware

Product BigFix WebUI

Weakness CWE-863 · Incorrect authorization

Published May 9, 2026

Last update May 11, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Key dates

02Disclosure timeline

May 9, 2026 CVE published

May 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-15633 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2026-27112 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-9791 Keycloak-rhel9: organization data leak after feature disabled in keycloak CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass CVE-2021-24207 WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts CVE-2023-30840 On a compromised node, the fluid-csi service account can be used to modify node specs