---
id: "CVE-2026-108047"
kind: "vulnerability"
aliases: ["CVE-2026-108047"]
title: "Alosuite: user invitation flaw lets attacker grant administrator rights"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ALO Suite", "fixed": ["26_04_15.03_10"], "affected": "25_09_15.03_35", "ecosystem": "vendor"}]
ecosystems: []
tags: ["alosuite", "am-system", "cloud", "other", "privilege-escalation", "saas"]
not_affected_if: ["invitation-feature-disabled"]
published_at: "2026-11-03T13:17:17+00:00"
first_seen_at: "2026-11-03T13:20:52+00:00"
updated_at: "2026-11-03T13:22:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108047", "first_seen_at": "2026-11-03T13:20:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T13:22:10+00:00"}]
---

# Alosuite: user invitation flaw lets attacker grant administrator rights

The /Requests/userInvitation endpoint in ALO Suite (AM System) does not check server-side which privileges an invitation assigns. By editing an intercepted invitation request, an attacker can create a new user with full administrator access. INCIBE reports it fixed in 26_04_15.03_10; no exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ALO Suite affected 25_09_15.03_35 fixed 26_04_15.03_10

## How to check

- Check your ALO Suite version: affected is 25_09_15.03_35; fixed in 26_04_15.03_10.
- Look for the /Requests/userInvitation endpoint in use.
- Review recently created users and confirm none hold administrator rights that were not granted on purpose.

## Fix

Move to ALO Suite 26_04_15.03_10 (April 2026) or later, per INCIBE relaying the vendor. Cloud-hosted product, so confirm with AM System which version your tenant runs.

## Timeline

- 2026-11-03T13:20:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108047
- 2026-11-03T13:22:10+00:00 analyst — INCIBE-CERT advisory INCIBE-2026-828 (coordinator, relays vendor): ALO Suite 25_09_15.03_35 affected, fixed in 26_04_15.03_10 (Apr 2026). Not marked verified: source is INCIBE, not AM System's own page; no vendor advisory found. INCIBE says attacker unauthenticated, CVSS v4 8.6 lists PR:L - discrepancy. No exploitation per INCIBE.

## Documents

- [advisory] INCIBE-CERT: Múltiples vulnerabilidades en ALO Suite de AM System (INCIBE-2026-828) https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-alo-suite-de-am-system

## From the sources

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_