CVE-2026-35147 describes a broken authentication vulnerability in HCL DFXServer where the application fails to verify the authentication status of users accessing specific API endpoints. This allows unauthenticated attackers to bypass authorization controls and perform unauthorized actions via direct API access. The vulnerability is categorized under CWE-639, indicating an authorization bypass through user-controlled keys. The CVSS 3.1 base score is 8.2, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity and no availability impact. No official remediation or patch information is provided in the available data.

An attacker can interact with the affected API endpoints without authentication, leading to unauthorized access to sensitive information (high confidentiality impact) and potentially unauthorized actions with limited integrity impact. There is no impact on availability. This could result in data exposure or unauthorized operations within the DFXServer environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints through network controls or API gateways to enforce authentication. Monitor for unusual API activity and apply principle of least privilege to API access where possible.