---
id: CVE-2026-108047
title: >-
  Inadequate authorization vulnerability in Alosuite’s user invitation
  functionality
summary: >-
  Inadequate authorization vulnerability in Alosuite’s user invitation
  functionality. The ‘/Requests/userInvitation’ endpoint does not properly
  validate the assignment of privileges on the server, allowing an attacker to
  manipulate the inv…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
vendor: AM System
product: ALO Suite
affected:
  - alo_suite 25_09_15.03_35
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T13:35:37.321934Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:35:53.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108047'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite
tags:
  - cve.org
epss: 0.00278
epssPercentile: 0.20372
ingestedAt: '2026-11-05T19:30:42.949Z'
---

## Overview

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.

## Affected

- `alo_suite 25_09_15.03_35`

## Remediation

The manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version.