CVE-2026-12686
Received Received - Intake

Cross-Tenant Authorization Bypass in Company Management System

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-06
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-12686
EUVD
EUVD-2026-41860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adiss biloop *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Adiss's Biloop platform and allows an authenticated user to manipulate a company ID parameter in a POST request to the backend.

Because the application does not properly verify whether the requested company ID belongs to the authenticated user's session, the attacker can gain unauthorized access to other companies hosted within the same subdomain environment.

This is known as a cross-tenant authorization bypass.

Impact Analysis

If exploited, this vulnerability allows unauthorized access to sensitive customer information, including billing data.

It may also enable unauthorized modification of third-party data, potentially leading to data breaches, financial loss, and damage to trust.

Mitigation Strategies

The vulnerability has been fixed in the latest version of Adiss's Biloop platform.

Users are advised to update to the latest version immediately to mitigate the risk of unauthorized access and data modification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart