CVE-2026-111651

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111651
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111651.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111651
Published
2026-10-16T17:39:18Z
Modified
2026-10-21T02:55:12Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
Details

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111651.json"
}
References

Affected packages

Git / github.com/risesoft-y9/digital-infrastructure

Affected ranges

Type
GIT
Repo
https://github.com/risesoft-y9/digital-infrastructure
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
b9dddb7c80d15c48ba912a6454fe926d6d191830
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "9.6.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v9.*
v9.6.11
v9.6.3
v9.6.4
v9.6.5
v9.6.6
v9.6.7
v9.6.8
v9.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111651.json"