{"affected":[{"defaultStatus":"unaffected","product":"ALO Suite","source":"CNA: INCIBE","vendor":"AM System","versions":[{"status":"affected","version":"25_09_15.03_35"}]}],"cveId":"CVE-2026-108047","cwes":["CWE-285"],"description":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793712953949,"publishedAt":1793708758988,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"The manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version."}],"revision":"72884df0f8b80c56af4d7af7261ade338f5f1c9b9b1af76d474018b24f096231","sources":[{"modifiedAt":1793712953949,"name":"CNA: INCIBE","retrievedAt":1793714910263,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108047"}],"ssvc":{"assessedAt":1793712937321,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality","updatedAt":1793714910263}