HCL BigFix Query's WebUI Query application has a sensitive information disclosure vulnerability. An HTTP GET endpoint can reveal group names and active user names or IDs. This information could be leveraged by attackers for targeted phishing or social engineering attacks. The vulnerability has a medium severity rating with a CVSS score of 4.2.