Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController

Advisories

Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController

Severity: high
Date: 10/16/2026
Affecting: Digital-Infrastructure <= 9.6.11
CVE: CVE-2026-111651
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 7.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/digital-infrastructure-log-download-cross-tenant-person-export
https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java#L47-L82
https://github.com/risesoft-y9/Digital-Infrastructure
Credit: hieuPenguinnn
Description: Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo