This vulnerability (CWE-862) in HCL BigFix WebUI arises from missing authorization checks, permitting authenticated users with insufficient privileges to view sensitive environmental data by accessing URLs directly. The vulnerability affects all versions of BigFix WebUI and does not require user interaction or elevated privileges beyond authentication. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and low impact on confidentiality. No vendor advisory or patch information is available to confirm remediation status.

An authenticated user without the necessary permissions can access sensitive environmental information, potentially leading to unauthorized disclosure of system details. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector. There is no indication of privilege escalation, integrity, or availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the BigFix WebUI to trusted users only and monitor for unauthorized access attempts. Avoid sharing URLs that may expose sensitive information and consider implementing additional access controls or web application firewalls to limit direct URL access.