CVE-2026-108047— Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Quick assessment

Affected

AM System ALO Suite

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Alosuite 的用户邀请功能中存在授权不足漏洞。接口未在服务器端正确验证权限分配，导致攻击者能够在请求过程中篡改邀请参数。攻击者可通过拦截并修改合法的邀请请求，在未经适当授权检查的情况下，为 newly invited（新邀请）用户分配管理员权限。成功利用该漏洞将导致未授权的权限提升，使攻击者获得受影响应用程序的完整管理员访问权限。

CVSS 8.6 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1551.003 T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Source: CVE Program / CVE List V5

Vulnerability Description

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AM System	ALO Suite	25_09_15.03_35	-

II. Public POCs for CVE-2026-108047

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-108047

请登录查看更多情报信息。

Other References for CVE-2026-108047 (1)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite

https://www.cve.org/CVERecord?id=CVE-2026-108047

Same Patch Batch · AM System · 2026-11-03 · 15 CVEs total

CVE-2026-108048	6.9 MEDIUM	Vulnerability due to a lack of request limits in Alosuite’s password recovery functionalit
CVE-2026-108046	6.9 MEDIUM	Direct Object Reference (IDOR) vulnerability in Alosuite
CVE-2026-108056	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108057	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108059	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108053	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108058	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108051	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108060	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108055	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108049	5.1 MEDIUM	Clickjacking vulnerability in the Alosuite web application.
CVE-2026-108052	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108050	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108054	5.1 MEDIUM	Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note

IV. Related Vulnerabilities

Same product: ALO Suite

Same vendor: AM System