---
id: CVE-2026-111651
title: >-
  Risesoft Digital-Infrastructure through 9.6.11 contains a missing
  authorization vulnerability in the log module DownloadController that allows
  authenticated users to export any tenant's personnel directory
summary: >-
  Risesoft Digital-Infrastructure through 9.6.11 contains a missing
  authorization vulnerability in the log module DownloadController that allows
  authenticated users to export any tenant's personnel directory. Attackers can
  supply another t…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: risesoft-y9
product: Digital-Infrastructure
affected:
  - Digital-Infrastructure <= 9.6.11
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T22:17:21.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111651'
references:
  - url: 'https://github.com/risesoft-y9/Digital-Infrastructure'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java#L47-L82
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@hieuPenguinnn/digital-infrastructure-log-download-cross-tenant-person-export
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/risesoft-digital-infrastructure-through-9.6.11-cross-tenant-data-exposure-via-downloadcontroller
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00304
epssPercentile: 0.23048
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:34:03.800229Z'
ingestedAt: '2026-10-16T18:43:08.676Z'
---

## Overview

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.