Inadequate Authorization in Alosuite's User Invitation Feature

CVE-2026-108047

What is CVE-2026-108047?

An inadequate authorization vulnerability exists in Alosuite’s user invitation functionality, specifically within the '/Requests/userInvitation' endpoint. This flaw allows an attacker to manipulate the invitation parameters without proper validation of privileges. By intercepting and modifying a legitimate user invitation request, an unauthenticated attacker can grant administrative rights to a newly invited user without the necessary authorization checks. As a result, this exploit can lead to unauthorized privilege escalation, providing the attacker with full administrative access to the affected application.

References