CVE-2025-15633: hclsoftware bigfix webui Incorrect Authorization

Vulnerability summary

CVE-2025-15633 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in hclsoftware bigfix webui. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.3% of scored vulnerabilities.

Timeline

1. 09-05-2026
   PublishedVulnerability first disclosed.
2. 11-05-2026
   Last modifiedVulnerability information updated.

Description

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.