Is CVE-2026-111651 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111651?

CVE-2026-111651 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111651

Description

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.