This vulnerability (CVE-2026-21836) in HCL DominoIQ version 14.5.1 involves missing authorization checks (CWE-862) in the RAG feature. Specifically, document-level access controls can be ignored when determining data returned from AI queries, enabling authenticated users to view sensitive information beyond their permissions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation level has been disclosed by HCLSoftware as of the publication date.

An authenticated attacker could bypass document-level access restrictions in DominoIQ 14.5.1's RAG feature and view sensitive data that should be protected. This impacts confidentiality but does not affect integrity or availability. The vulnerability requires the attacker to have some level of privileges (PR:L) and can be exploited remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published by HCLSoftware, users should monitor vendor communications for updates. Until a patch is available, restrict access to the affected DominoIQ version to trusted users only and consider limiting exposure of the RAG feature where possible.