HCL DominoIQ Broken Access Control Vulnerability Allowing Unauthorized Data Access

A broken access control vulnerability has been identified in the HCL DominoIQ RAG feature, specifically in version 14.5.1. Under certain conditions, document-level access restrictions may be bypassed when processing AI queries, potentially allowing authenticated attackers to access sensitive data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data by authenticated users.

Remediation

This vulnerability is fixed in HCL Domino version 14.5.1 Interim Fix 1 and later. The latest Notes/Domino fix releases can be downloaded from My HCLSoftware. If there are issues accessing this link, refer to the HCL Support Page KB0109011.