---
id: "CVE-2026-108046"
kind: "vulnerability"
aliases: ["CVE-2026-108046"]
title: "Alosuite: unauthenticated IDOR exposes other companies' and users' data"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["alosuite", "other", "self-hosted"]
not_affected_if: ["not-alosuite"]
published_at: "2026-11-03T13:17:17+00:00"
first_seen_at: "2026-11-03T13:20:51+00:00"
updated_at: "2026-11-03T13:21:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108046", "first_seen_at": "2026-11-03T13:20:51+00:00"}]
---

# Alosuite: unauthenticated IDOR exposes other companies' and users' data

Alosuite does not check authorization when it processes object identifiers in the /Companies/Edit/{id} endpoint. An unauthenticated remote attacker can change the identifier, enumerate valid ones, and read company and user data they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T13:20:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108046

## From the sources

Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_