# CVE-2026-111651: Risesoft Digital-Infrastructure missing authorization in log DownloadController

Source: https://junglewise.ai/threats/cve-2026-111651-risesoft-digital-infrastructure-through-9-6-11-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111651 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Risesoft Digital-Infrastructure is a unified management platform used by government and enterprise organizations for identity authentication, organization structure, and access control. A flaw in the log module allows authenticated users to export personnel directories belonging to other tenants by supplying a different tenant ID, exposing names, login names, organization paths, mobile numbers, and email addresses without proper authorization checks.

Technologies: [Risesoft Digital-Infrastructure](https://junglewise.ai/threats/technologies/digital-infrastructure). Vendors: [Risesoft](https://junglewise.ai/threats/vendors/risesoft).

## Quick answers

**Is CVE-2026-111651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111651 being exploited in the wild.

**How severe is CVE-2026-111651?** Medium severity, with a CVSS score of 6.5, published 16 October 2026.

**Which products and versions are affected?** Risesoft Digital-Infrastructure through 9.6.11.

**Is there a fix for CVE-2026-111651?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111651 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111651?** Check whether you run Risesoft Digital-Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DownloadController in the log module fails to validate tenant ownership when processing exportLoginXLS and exportNotLoginXLS requests. An authenticated attacker can supply an arbitrary tenantId parameter to retrieve and export personnel data from any tenant in the system. The vulnerability is a missing authorization check (CWE-862) affecting multi-tenant isolation.

## Affected products

- Risesoft Digital-Infrastructure through 9.6.11

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/risesoft-y9/Digital-Infrastructure](https://github.com/risesoft-y9/Digital-Infrastructure)
- [https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java](https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-log/risenet-y9boot-support-log-web/src/main/java/net/risesoft/controller/DownloadController.java)

## Related threats

- [Risesoft-y9 Digital-Infrastructure path traversal in fileManager](https://junglewise.ai/threats/cve-2026-110116-risesoft-y9-digital-infrastructure-9-6-5-through-9-6-11-contains)
- [Risesoft Digital-Infrastructure path traversal in file manager](https://junglewise.ai/threats/cve-2026-110115-risesoft-digital-infrastructure-9-6-5-through-9-6-11-contains-a)
- [Digital-Infrastructure SSO authentication bypass](https://junglewise.ai/threats/cve-2026-79576-digital-infrastructure-sso-authentication-bypass)