{"id":"CVE-2026-21826","state":"PUBLISHED","title":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","publishedAt":"2026-06-05T05:58:31.449Z","updatedAt":"2026-06-09T14:38:10.191Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"HCL"},"assigner":"HCL","products":["HCLSoftware Digital Experience & DX Compose"],"affected":[{"vendor":"HCLSoftware","product":"Digital Experience & DX Compose","defaultStatus":"unaffected","versions":[{"version":"9.5","status":"affected"}]}],"references":["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849"],"weaknesses":["CWE-601"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/21xxx/CVE-2026-21826.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-21826","state":"PUBLISHED","datePublished":"2026-06-05T05:58:31.449Z","dateUpdated":"2026-06-09T14:38:10.191Z","assignerShortName":"HCL","assignerOrgId":"1e47fe04-f25f-42fa-b674-36de2c5e3cfc","dateReserved":"2026-01-05T16:08:22.255Z"},"containers":{"cna":{"title":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection","descriptions":[{"lang":"en","value":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways."}],"affected":[{"vendor":"HCLSoftware","product":"Digital Experience & DX Compose","defaultStatus":"unaffected","versions":[{"version":"9.5","status":"affected"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","lang":"en","description":"CWE-601 URL redirection to untrusted site ('open redirect')","type":"CWE"}]}],"providerMetadata":{"shortName":"HCL","orgId":"1e47fe04-f25f-42fa-b674-36de2c5e3cfc","dateUpdated":"2026-06-05T05:58:31.449Z"},"datePublic":"2026-06-05T05:37:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-09T13:28:00.599027Z","id":"CVE-2026-21826","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-09T14:38:10.191Z"}}]}}}