CVE-2025-55261: high-severity vulnerability in HCL Aftermarket DPC
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Aftermarket DPC lacks proper access controls at the functional level, allowing attackers to gain unauthorized privileges and access or modify sensitive data within the application.
Missing functional-level access control in HCL Aftermarket DPC enables privilege escalation attacks where authenticated or unauthenticated users can bypass authorization checks to access restricted features. The vulnerability permits unauthorized data exfiltration and modification, compromising data integrity and confidentiality.
In the same product, most dangerous first.