CVE-2026-111651 risesoft-y9 CVE debrief

Who should care

Defenders and administrators of Risesoft Digital-Infrastructure systems should assess their exposure and prioritize remediation, especially in environments where data privacy and security are critical.

Why it matters

CVE-2026-111651 is a significant vulnerability in Risesoft Digital-Infrastructure that allows authenticated users to export sensitive information from other tenants. Defenders should prioritize verifying and remediating this vulnerability to prevent potential unauthorized data access and exposure.

• Potential unauthorized data access and exposure
• Risk of sensitive information disclosure
• Need for verification of system versions and remediation status
• Potential impact on data privacy and compliance

Technical summary

The vulnerability is located in the log module DownloadController of Risesoft Digital-Infrastructure through 9.6.11. An authenticated user can export any tenant's personnel directory by manipulating the tenantId in the exportLoginXLS or exportNotLoginXLS functions. This allows attackers to obtain sensitive information such as names, login names, organization paths, mobile numbers, and emails from other tenants. The vulnerability has a significant impact on data privacy and security, particularly in environments where unauthorized data access could have severe consequences.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where unauthorized data access could have significant impacts.

Recommended defensive actions

• Verify the version of Risesoft Digital-Infrastructure and check if it is vulnerable
• Restrict access to the log module DownloadController
• Implement proper authorization checks for exporting tenant data
• Monitor for suspicious activity related to data exports
• Perform a thorough review of system logs for any signs of exploitation
• Ensure that all instances of Risesoft Digital-Infrastructure are updated to the latest version
• Conduct a comprehensive risk assessment to identify potential vulnerabilities and prioritize remediation

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from other sources is needed to fully understand the impact and remediation. The vulnerability is located in the log module DownloadController of Risesoft Digital-Infrastructure through 9.6.11. An authenticated user can export any tenant's personnel directory by manipulating the tenantId in the exportLoginXLS or exportNotLoginXLS functions. However, the current information available is limited, and defenders should verify the version of Rr

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.