CVE-2026-108046
Received Received - Intake

IDOR Vulnerability in Alosuite Exposes Sensitive Company Data

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-108046
EUVD
EUVD-2026-115795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AM System ALO Suite 25_09_15.03_35

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Direct Object Reference (IDOR) vulnerability in Alosuite caused by weak authorization checks. Attackers can manipulate object identifiers in the '/Companies/Edit/{id}' endpoint to access unauthorized data. The flaw allows unauthenticated remote attackers to guess valid IDs and retrieve restricted information.

Detection Guidance

To detect this IDOR vulnerability, monitor HTTP requests to the '/Companies/Edit/{id}' endpoint for unauthorized access attempts. Check server logs for repeated requests with modified identifiers. Use tools like Burp Suite or OWASP ZAP to intercept and manipulate object identifiers in requests to test for unauthorized data exposure.

Impact Analysis

An attacker could access sensitive company or user data without permission, leading to data breaches. This may result in financial loss, reputational damage, or legal consequences depending on the exposed information.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal or sensitive data without authorization. Organizations may face fines, legal penalties, or mandatory audits for non-compliance.

Mitigation Strategies

Implement proper authorization checks to ensure users can only access data they are permitted to. Use session-based or role-based access controls. Validate and sanitize all object identifiers in the '/Companies/Edit/{id}' endpoint to prevent enumeration. Apply patches or updates from the vendor if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...