{"id":"CVE-2026-108047","kind":"vulnerability","aliases":["CVE-2026-108047"],"related":[],"title":"Alosuite: user invitation flaw lets attacker grant administrator rights","description":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.","summary":"The /Requests/userInvitation endpoint in ALO Suite (AM System) does not check server-side which privileges an invitation assigns. By editing an intercepted invitation request, an attacker can create a new user with full administrator access. INCIBE reports it fixed in 26_04_15.03_10; no exploitation reported.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ALO Suite","fixed":["26_04_15.03_10"],"affected":"25_09_15.03_35","ecosystem":"vendor"}],"ecosystems":[],"tags":["alosuite","am-system","cloud","other","privilege-escalation","saas"],"not_affected_if":["invitation-feature-disabled"],"how_to_check":"- Check your ALO Suite version: affected is 25_09_15.03_35; fixed in 26_04_15.03_10.\n- Look for the /Requests/userInvitation endpoint in use.\n- Review recently created users and confirm none hold administrator rights that were not granted on purpose.","fix":"Move to ALO Suite 26_04_15.03_10 (April 2026) or later, per INCIBE relaying the vendor. Cloud-hosted product, so confirm with AM System which version your tenant runs.","status":"open","published_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","triaged_at":"2026-11-03T13:21:30+00:00","updated_at":"2026-11-03T13:22:10+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-03T13:21:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Alosuite: user invitation flaw lets attacker grant administrator rights","impact":"high","summary":"The user invitation endpoint in Alosuite does not check on the server which privileges an invitation assigns. An attacker who intercepts and edits a legitimate invitation request can create a new user with full administrator access.","audience":"businesses","category":"other","nicknames":[],"who_cares":["alosuite"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains full administrator access to the application","analyst_note":"Find the affected and fixed Alosuite versions and any vendor advisory, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-108047.","how_to_check":"- Look for the `/Requests/userInvitation` endpoint in the Alosuite deployment.\n- Review accounts created recently and confirm whether any hold administrator rights that were not granted on purpose.\n- Affected versions: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["invitation-feature-disabled"],"who_is_affected":"Teams running Alosuite with the user invitation feature reachable over the network. The sources do not name affected versions or say whether the feature is on by default, so the team should check its own deployment.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4196,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Alosuite versions and any vendor advisory, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-108047.","search":"'-108047':12A,15A '-2026':11A,14A '/requests/userinvitation':29B,86C '04':70B '10':72B '15.03':71B '26':69B 'access':63B,147C 'administr':8A,62B,124C,146C 'affect':150C 'allow':99C 'alo':16A,32B 'alosuit':1A,18B,80C 'am-system':19B 'applic':151C 'appropri':133C 'assign':46B,93C,123C 'attack':6A,54B,101C,121C 'author':77C,134C 'check':38B,135C 'cloud':22B 'creat':56B 'cve':10A,13A 'edit':48B 'endpoint':30B,87C 'escal':26B,143C 'exploit':74B,138C 'fix':67B 'flaw':4A 'full':61B,145C 'function':84C 'grant':7A,144C 'inadequ':76C 'incib':64B 'intercept':50B,112C 'invit':3A,45B,51B,83C,105C,117C,129C 'legitim':116C 'let':5A 'manipul':103C 'modifi':114C 'new':58B 'newli':128C 'paramet':106C 'privileg':25B,43B,95C,125C,142C 'privilege-escal':24B 'process':110C 'proper':90C 'report':65B,75B 'request':52B,109C,118C 'result':139C 'right':9A 'saa':27B 'server':40B,98C 'server-sid':39B 'side':41B 'success':137C 'suit':33B 'suite':17A 'system':21B,35B 'unauthent':120C 'unauthor':141C 'user':2A,59B,82C,130C 'valid':91C 'vulner':78C 'without':131C","nicknames":[],"mitigations":[],"who_affected":"Teams using AM System's ALO Suite, a cloud business management app (invoicing, accounting), at version 25_09_15.03_35. Anyone able to send invitation requests could make themselves an administrator. Customers already on 26_04_15.03_10 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["alosuite","suite"],"ptokens":["alo","suite"],"labels":["alosuite","amsystem","cloud","high","other","privilegeescalation","saas"],"first_public_at":"2026-11-03T13:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108047","severity":null,"published_at":"2026-11-03T13:17:17+00:00","modified_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","fetched_at":"2026-11-03T13:20:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-108047:1487","url":null,"severity":null,"published_at":"2026-11-03T13:22:10+00:00","modified_at":"2026-11-03T13:22:10+00:00","first_seen_at":"2026-11-03T13:22:10+00:00","fetched_at":"2026-11-03T13:22:10+00:00","note":"INCIBE-CERT advisory INCIBE-2026-828 (coordinator, relays vendor): ALO Suite 25_09_15.03_35 affected, fixed in 26_04_15.03_10 (Apr 2026). Not marked verified: source is INCIBE, not AM System's own page; no vendor advisory found. INCIBE says attacker unauthenticated, CVSS v4 8.6 lists PR:L - discrepancy. No exploitation per INCIBE."}],"documents":[{"id":57753,"url":"https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-alo-suite-de-am-system","title":"INCIBE-CERT: Múltiples vulnerabilidades en ALO Suite de AM System (INCIBE-2026-828)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}