{"id":"CVE-2026-108047","title":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality","summary":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the inv…","severity":"high","cvss":8.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","vendor":"AM System","product":"ALO Suite","affected":["alo_suite 25_09_15.03_35"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T13:35:37.321934Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T13:35:53.949Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108047","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"}],"tags":["cve.org"],"epss":0.00278,"epssPercentile":0.20372,"ingestedAt":"2026-11-05T19:30:42.949Z","slug":"CVE-2026-108047","body":"## Overview\n\nInadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.\n\n## Affected\n\n- `alo_suite 25_09_15.03_35`\n\n## Remediation\n\nThe manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}