CVE-2026-21827: CWE-359 Exposure of private personal information to an unauthorized actor in HCLSoftware Connections

CVE-2026-21827 describes an information disclosure vulnerability in HCL Connections where improper handling of request data enables unauthorized actors to obtain private personal information they should not access. This vulnerability affects versions 7.0 and 8.0 of the product. The CVSS 3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact. No official remediation or patch information is available, and the vendor has not indicated a fix or mitigation level.

Unauthorized users may gain access to sensitive personal information due to improper request data handling. The confidentiality impact is limited, and there is no impact on integrity or availability. The vulnerability requires user interaction and has a high attack complexity, reducing the likelihood of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control access to HCL Connections and monitor for unusual access patterns. No vendor-provided mitigation or temporary fix is currently documented.