{"id":"CVE-2026-108046","kind":"vulnerability","aliases":["CVE-2026-108046"],"related":[],"title":"Alosuite: unauthenticated IDOR exposes other companies' and users' data","description":"Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.","summary":"Alosuite does not check authorization when it processes object identifiers in the /Companies/Edit/{id} endpoint. An unauthenticated remote attacker can change the identifier, enumerate valid ones, and read company and user data they should not see.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alosuite","other","self-hosted"],"not_affected_if":["not-alosuite"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:51+00:00","triaged_at":"2026-11-03T13:21:34+00:00","updated_at":"2026-11-03T13:21:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T13:21:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Alosuite: unauthenticated IDOR exposes other companies' and users' data","impact":"medium","summary":"Alosuite does not check authorization when it processes object identifiers in the /Companies/Edit/{id} endpoint. An unauthenticated remote attacker can change the identifier, enumerate valid ones, and read company and user data they should not see.","audience":"businesses","category":"other","nicknames":[],"who_cares":["alosuite","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads other companies' and users' application data without logging in","analyst_note":"Find affected Alosuite versions and the vendor fix from the NVD entry or the vendor advisory; the sources give no version range.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-alosuite"],"who_is_affected":"Any deployment of Alosuite that exposes the /Companies/Edit/{id} endpoint to the network is potentially exposed, since the sources describe no authentication requirement. Teams that do not run Alosuite can skip it. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":4199,"output_tokens":460,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108046':12A,15A '-2026':11A,14A '/companies/edit':33B,80C 'access':86C 'allow':100C 'alosuit':1A,16B,21B,63C 'applic':125C 'appropri':96C 'associ':88C 'attack':39B,84C,103C 'author':25B,67C,97C,117C 'chang':41B 'check':24B,68C 'compani':6A,49B,91C 'cve':10A,13A 'data':9A,52B,126C 'direct':57C 'disclosur':123C 'due':64C 'endpoint':35B,82C 'enumer':44B,105C 'expos':4A 'host':20B 'id':34B,81C 'identifi':30B,43B,72C,76C,108C 'idor':3A,60C 'inform':87C,111C 'insuffici':66C 'modifi':74C 'object':29B,58C,71C,107C 'one':46B 'process':28B,70C 'provid':77C 'read':48B 'refer':59C 'remot':38B,102C 'restrict':115C 'result':119C 'retriev':110C 'see':56B 'self':19B 'self-host':18B 'unauthent':2A,37B,101C 'unauthor':122C 'user':8A,51B,93C,118C 'valid':45B,106C 'vulner':61C,99C 'without':94C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Alosuite that exposes the /Companies/Edit/{id} endpoint to the network is potentially exposed, since the sources describe no authentication requirement. Teams that do not run Alosuite can skip it. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alosuite","medium","other","selfhosted"],"first_public_at":"2026-11-03T13:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108046","severity":null,"published_at":"2026-11-03T13:17:17+00:00","modified_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:51+00:00","fetched_at":"2026-11-03T13:20:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}