CVE-2026-21836
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document-level access restrictions are ignored when determining what data to return from an AI query. An authenticated attacker can view sensitive data.
Risk Assessment
An attacker can gain unauthorized access to sensitive data, potentially compromising information confidentiality in the organization.
Recommendation
Contact HCL for patches and temporarily restrict access to the RAG feature.
Original NVD description (English source)
The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data.