CVE-2026-21760
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
Risk Assessment
The risk involves potential takeover of the application by an unauthorized user, which could lead to compromise of data confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately update HCL DevOps Loop to the latest patched version and implement additional access control mechanisms such as multi-factor authentication.
Other vulnerabilities in HCL DevOps Loop
See all- CVE-2026-21764Low
The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
- CVE-2026-21762Low
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
- CVE-2026-21761Medium
CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
Original NVD description (English source)
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.