CVE-2026-111651

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

CVE-2026-111651 Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

CVE-2026-111651

Risesoft Digital-Infrastructure versions through 9.6.11 are affected by a missing authorization vulnerability within the DownloadController of the log module. This flaw allows authenticated users to perform cross-tenant data exposure by providing a different tenantId to the exportLoginXLS or expo...