Authorization Bypass Vulnerability in AiSOC by Beenuar

CVE-2026-103054

What is CVE-2026-103054?

AiSOC versions prior to 12.0.0 exhibit an authorization bypass vulnerability within the MSSP module, which permits authenticated users to maliciously add unauthorized tenants to their portfolios. This flaw allows attackers to exploit the add_tenants_to_portfolio endpoint, where they can submit tenant UUIDs to claim unassigned tenants. Once successful, they gain access to sensitive information such as security alerts, incidents, and posture metrics without proper authorization or consent from the legitimate owner.

References