CVE-2026-56568 LOW

CVE-2026-56568: HCL iControl is affected by multiple security vulnerabilities.

Vendor Hcl Software

Product HCL iControl

Weakness CWE-209 · Error message info leak

Published July 31, 2026

Last update July 31, 2026

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status

Key dates

02Disclosure timeline

July 31, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-56568 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html AskarLabs — CWE-209 write-up Generation of Error Message Containing Sensitive Information

Related vulnerabilities

04Related CVE

CVE-2024-13540 WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure CVE-2025-32238 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability CVE-2025-24552 WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability CVE-2024-13535 Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure CVE-2024-50512 WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerability