CVE-2026-111651 in Digital-Infrastructure
Summary
by MITRE • 10/16/2026
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Risesoft Digital-Infrastructure version 9.6.11 represents a critical failure in access control mechanisms within the application's log management module. Specifically, the flaw resides in the DownloadController component, which handles requests for exporting personnel directory data. The core technical issue is an insecure direct object reference where the system fails to validate whether the authenticated user requesting the export has administrative privileges or ownership rights over the specific tenant identified by the provided tenantId parameter. This lack of server-side authorization checks allows any logged-in user to bypass intended isolation boundaries between different tenants in a multi-tenant architecture, effectively treating all tenant identifiers as accessible resources regardless of the requester's actual permissions.
From an operational perspective, this vulnerability enables authenticated attackers to perform unauthorized data exfiltration on a massive scale. By manipulating the input parameters for functions such as exportLoginXLS or exportNotLoginXLS, an attacker can supply arbitrary tenantId values corresponding to other organizations hosted within the same instance of the software. Upon successful exploitation, the system generates and delivers XLSX files containing sensitive personally identifiable information belonging to those tenants. The exposed data fields include full names, login credentials identifiers, organizational hierarchy paths, mobile phone numbers, and email addresses. This constitutes a severe breach of confidentiality for all affected entities sharing the infrastructure, as it provides attackers with comprehensive contact directories that can be leveraged for further social engineering attacks or credential stuffing campaigns.
This vulnerability aligns directly with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user authorization before granting access to specific objects or resources. Furthermore, from the perspective of the MITRE ATT&CK framework, this behavior is characteristic of T1078 Valid Accounts and potentially supports data exfiltration techniques by providing attackers with structured datasets that facilitate subsequent phases of an attack lifecycle. The ability to export large volumes of personnel data in a machine-readable format significantly lowers the barrier for automated harvesting tools, increasing the risk of widespread identity theft or targeted phishing operations against employees across multiple organizations.
To mitigate this vulnerability, immediate remediation should focus on implementing strict server-side authorization checks within the DownloadController logic. Developers must ensure that every request to export personnel data verifies not only that the user is authenticated but also that they possess explicit administrative rights for the specific tenantId being requested. This can be achieved by integrating role-based access control (RBAC) policies that validate the relationship between the current session's tenant context and the target resource identifier before processing the export command. Additionally, implementing rate limiting on these endpoints can help mitigate bulk data scraping attempts while more permanent code fixes are deployed. Organizations relying on this version of Risesoft Digital-Infrastructure should apply vendor-provided patches promptly to restore proper isolation boundaries between tenants and prevent further unauthorized access to sensitive personnel records.