CVE-2026-21836

Description

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.

PUBLISHED Reserved 2026-01-05 | Published 2026-05-20 | Updated 2026-05-20 | Assigner HCL

Problem types

CWE-862 Missing Authorization

Product status

References

support.hcl-software.com/...rticle&sysparm_article=KB0130932

cve.org (CVE-2026-21836)

nvd.nist.gov (CVE-2026-21836)

Download JSON