AM System ALO Suite 25_09_15.03_35 User Invitation /Requests/userInvitation improper authorization

Summaryinfo

A vulnerability described as critical has been identified in AM System ALO Suite 25_09_15.03_35. The affected element is an unknown function of the file /Requests/userInvitation of the component User Invitation. The manipulation results in improper authorization. This vulnerability is known as CVE-2026-108047. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in AM System ALO Suite 25_09_15.03_35. It has been classified as critical. Affected is an unknown code block of the file /Requests/userInvitation of the component User Invitation. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.

The advisory is shared for download at incibe.es. This vulnerability is traded as CVE-2026-108047 since 10/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/03/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• AM System

Name

• ALO Suite

Version

• 25_09_15.03_35

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion