CVE-2025-52603: 
NixOS vulnerability analysis and mitigation

CVE-2025-52603 is an information disclosure vulnerability in HCL Connections that exposes internal metadata to authenticated users under a very specific navigation scenario. The vulnerability affects HCL Connections versions 7.0, 8.0, and all 8.0 cumulative releases (CR1 through CR10). It was published on February 20, 2026, with a patch available via HCL's support portal. It carries a CVSS v3.1 base score of 3.5 (Low) (HCL Support).

The vulnerability is classified as CWE-213 (Exposure of Sensitive Information Due to Incompatible Policies), meaning internal metadata is inadvertently returned to the browser due to a policy mismatch in how certain navigation flows are handled. Exploitation requires an authenticated user with low privileges to follow a specific navigation sequence, after which a single piece of internal metadata is surfaced in the browser response. The attack vector is network-based, requires user interaction, and has low attack complexity, but the narrow triggering conditions significantly limit its practical exploitability. No public proof-of-concept or technical write-up has been identified (HCL Support).

Successful exploitation results in limited confidentiality impact — specifically, the exposure of a single piece of internal metadata visible in the authenticated user's browser. There is no impact to integrity or availability, and the scope of the vulnerability is unchanged (confined to the affected system). The narrow triggering conditions and minimal data exposure make lateral movement or significant data exfiltration unlikely (HCL Support).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.029%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated session and a very specific user navigation path, further reducing practical risk (HCL Support).

HCL has released a patch addressing this vulnerability, available through the HCL support portal (KB0124242). All affected versions — HCL Connections 7.0, 8.0, and 8.0 CR1 through CR10 — should be updated. Given the low CVSS score and limited impact, patching priority is moderate, but organizations should apply the fix as part of routine maintenance cycles (HCL Support).