Direct Object Reference Vulnerability in Alosuite by AM Systems

CVE-2026-108046

What is CVE-2026-108046?

The vulnerability in Alosuite arises from inadequate authorization measures when handling object identifiers, particularly noted at the '/Companies/Edit/{id}' endpoint. This security flaw allows a malicious actor to manipulate the identifier and gain unauthorized access to sensitive information tied to other companies or users. As a result, unauthenticated remote attackers can effectively enumerate valid object identifiers, leading to the potential exposure of restricted application data that should only be accessible to authorized personnel.

References