risesoft-y9 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH risesoft-y9 CVE published 2026-10-16

CVE-2026-111651

CVE-2026-111651 is a missing authorization vulnerability in Risesoft Digital-Infrastructure through 9.6.11, allowing authenticated users to export any tenant's personnel directory via the log module DownloadController. Attackers can manipulate the tenantId to obtain sensitive information from other tenants. This vulnerability has significant implications for data privacy and security, particularly in envi [truncated]