Live › vulnerability › CVE-2026-108047
The /Requests/userInvitation endpoint in ALO Suite (AM System) does not check server-side which privileges an invitation assigns. By editing an intercepted invitation request, an attacker can create a new user with full administrator access. INCIBE reports it fixed in 26_04_15.03_10; no exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 13:20 UTC. All times on this page are UTC.
Teams using AM System's ALO Suite, a cloud business management app (invoicing, accounting), at version 25_09_15.03_35. Anyone able to send invitation requests could make themselves an administrator. Customers already on 26_04_15.03_10 or later can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ALO Suite | vendor | 25_09_15.03_35 | 26_04_15.03_10 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.
This page as .md · .json · in your agent: get_signal("CVE-2026-108047")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.