CVE-2025-55261

HIGH

HCL Aftermarket DPC is affected by Missing Functional Level Access Control

Title source: cna

Description

HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.

References (1)

Core 1

Core References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793

Scores

CVSS v3 8.1

EPSS 0.0002

EPSS Percentile 4.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (2)

HCL/Aftermarket DPC version 1.0.0

hcltech/aftermarket_cloud 1.0.0

Published Mar 26, 2026

Tracked Since Mar 26, 2026