CVE-2026-21756

HighCVSS 7.2/10Last modified Oct 12, 2026

Description

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-217583.7HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the hCVE-2026-217594.3HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitiveCVE-2026-21768.8A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of theCVE-2026-217604.6HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks CVE-2026-217615.4HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cCVE-2026-217625.3HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-basCVE-2026-217644.3HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may resultCVE-2026-217657.8HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys located on a Windows CVE-2026-217665.4The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very CVE-2026-217673.3HCL BigFix Platform is affected by insufficient authentication.  The application might allow users to access sensitive areas of the applicatCVE-2026-217686.3The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTMCVE-2026-21777.3A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component