CVE-2026-56547: CWE-20 Improper input validation in HCLSoftware Traveler

This vulnerability concerns improper input validation (CWE-20) in HCLSoftware Traveler's Apple profile generation for built-in Apple Mail, Calendar, and Contacts synchronization. The profile generation page requests Logon Name and Mail Address values, which are embedded in the profile and cannot be changed afterward. The system does not verify that the submitted values correspond to the authenticated user's Domino directory entry, potentially allowing an attacker to manipulate the profile data. Despite this, the profile cannot be used without further information, restricting the impact to the attacker's own device. No known exploits are reported, and no official remediation or patch is currently documented.

The vulnerability has a low impact as it does not allow compromise beyond the attacker's own device. There is no confidentiality, integrity, or availability impact on other users or systems. The profile generated with manipulated values is not usable without additional information, limiting the scope of exploitation.

No official remediation or patch is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability only affects the profile generation process and the profile is not usable without additional information, no urgent action is required at this time.