Live › vulnerability › CVE-2026-111651
Go to dashboardRisesoft Digital-Infrastructure through 9.6.11 has a missing authorization check in its log module's DownloadController. An authenticated user can pass another tenant's tenantId to the export endpoints and download XLSX files containing names, login names, organization paths, mobile numbers and emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Risesoft Digital-Infrastructure at or below 9.6.11 in a multi-tenant setup, where more than one tenant shares an instance. Single-tenant deployments and installs on a newer version are not described as exposed by the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
This page as .md · .json · in your agent: get_signal("CVE-2026-111651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.