CVE-2026-21760 is a CWE-425 Direct Request (Forced Browsing) vulnerability in HCLSoftware DevOps Loop. It arises from improper authorization checks that permit unauthorized users to access protected administrative endpoints directly. The vulnerability affects version 2.0.0 of the product. The CVSS 3.1 base score is 4.6 (medium), reflecting network attack vector, low complexity, low privileges required, user interaction needed, and limited confidentiality and integrity impact without availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Unauthorized users with limited privileges may gain access to administrative functionality that should be restricted, potentially leading to limited confidentiality and integrity impacts within the affected system. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected version 2.0.0 of HCL DevOps Loop and monitor for unusual access patterns to administrative endpoints. Avoid exposing administrative interfaces to untrusted networks where possible.