---
id: CVE-2026-111651
title: >-
  Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via
  DownloadController
summary: >-
  Risesoft Digital-Infrastructure through 9.6.11 contains a missing
  authorization vulnerability in the log module DownloadController that allows
  authenticated users to export any tenant's personnel directory. Attackers can
  supply another t…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: risesoft-y9
product: Digital-Infrastructure
affected:
  - Digital-Infrastructure <= 9.6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:34:03.800229Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T21:18:33.584Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111651'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/digital-infrastructure-log-download-cross-tenant-person-export
  - url: >-
      https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java#L47-L82
  - url: 'https://github.com/risesoft-y9/Digital-Infrastructure'
  - url: >-
      https://www.vulncheck.com/advisories/risesoft-digital-infrastructure-through-9.6.11-cross-tenant-data-exposure-via-downloadcontroller
    label: >-
      VulnCheck Advisory: Risesoft Digital-Infrastructure through 9.6.11
      Cross-Tenant Data Exposure via DownloadController
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.676Z'
---

## Overview

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

## Affected

- `Digital-Infrastructure <= 9.6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.