Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108048— Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.

Quick assessment

Affected
AM System ALO Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

由于 AloSuite 的密码恢复功能缺乏请求限制，存在安全漏洞。 接口未对单个账户的密码重置请求数量或频率实施充分限制。因此，远程攻击者可反复调用该接口，为同一用户生成无限数量的密码重置邮件，从而引发邮件洪水攻击，并滥用密码恢复机制。由于缺少请求限制或其他针对自动化的控制措施，该漏洞可能损害合法用户的正常使用，消耗应用及邮件基础设施资源，并助长针对密码恢复服务的自动化攻击。

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108048

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.
Source: CVE Program / CVE List V5
Vulnerability Description
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AM System ALO Suite 25_09_15.03_35 -

II. Public POCs for CVE-2026-108048

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108048

请登录查看更多情报信息。

Other References for CVE-2026-108048 (1)

Same Patch Batch · AM System · 2026-11-03 · 15 CVEs total

CVE-2026-108047 8.6 HIGH Inadequate authorization vulnerability in Alosuite’s user invitation functionality
CVE-2026-108046 6.9 MEDIUM Direct Object Reference (IDOR) vulnerability in Alosuite
CVE-2026-108056 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108057 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108059 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108053 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108058 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108051 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108060 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108055 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108049 5.1 MEDIUM Clickjacking vulnerability in the Alosuite web application.
CVE-2026-108052 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108050 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108054 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note

IV. Related Vulnerabilities

Same product: ALO Suite
Same vendor: AM System
Same weakness: CWE-770