CVE-2026-111651: Authorization Bypass Through User-Controlled Key in risesoft-y9 Digital-Infrastructure

Risesoft Digital-Infrastructure through version 9.6.11 contains a missing authorization vulnerability in the log module DownloadController. Authenticated users can exploit this by providing a tenantId of another tenant to the exportLoginXLS or exportNotLoginXLS functions, enabling unauthorized export of XLSX files containing personnel directory information including names, login names, organization paths, mobile numbers, and emails. This vulnerability allows unauthorized access to sensitive tenant data due to insufficient access control checks.

An attacker with valid authentication can access and export sensitive personnel directory information from any tenant, potentially leading to privacy violations and information disclosure. The data exposed includes personally identifiable information such as names, login names, organizational structure, mobile phone numbers, and email addresses. This could facilitate further targeted attacks or social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected export functions to trusted users only and monitor for unauthorized export attempts. Implement additional access control checks on tenantId parameters if possible.