Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
CVE-2026-111651
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111651
Digital-Infrastructure
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/risesoft-y9/Digital-Infrastructure",
"vendor": "risesoft-y9",
"product": "Digital-Infrastructure",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "9.6.11"
}
],
"packageURL": "pkg:github/risesoft-y9/Digital-Infrastructure",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111651
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34435 · Revision 1
- Added to Heist Feed
- Publisher date