Alo Suite CVE-2026-108047

Exploitation targets the specific '/Requests/userInvitation' endpoint of Alo Suite's user-invitation feature, which fails to validate privilege assignment server-side; the attacker must be able to intercept and tamper with the parameters of an invitation request so the invited account is granted administrative privileges. A limiting factor is unresolved in the sources: the description states the attacker is unauthenticated, but the CVSS vector encodes PR:L (requiring some level of authenticated access, e.g. the ability to initiate an invitation), so realistic exploitation may require at least a low-privileged account or the ability to capture an in-flight legitimate invitation request - verify with the INCIBE/vendor advisory. No user interaction is required (UI:N) and the trigger beyond parameter manipulation of the invitation request is not further described in the available sources.

This is a server-side authorization flaw (broken access control / privilege escalation) in AM Systems' Alo Suite invitation workflow, reported by INCIBE (Spain's CERT). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 and describes a network-reachable, low-complexity attack yielding high confidentiality and integrity impact with no availability impact. A key signal conflict must be flagged: the description explicitly calls the attacker 'unauthenticated,' yet the CVSS vector encodes PR:L (some privileges required) - these disagree, so authentication requirements are not reliably confirmed from the available data and should be verified with the vendor/INCIBE advisory. The vuln.today decision label is 'this_week,' indicating a prioritized-but-not-emergency triage tier rather than act_now/emergency. There is no CISA KEV listing, no EPSS score, and no PoC or exploit reference in the input, so there is no public evidence of active exploitation or available exploit code at this time. Net assessment: a genuinely high-severity access-control bug worth patching on a near-term (this-week) schedule given full administrative takeover potential, but with no current exploitation signal - the real risk is bounded largely by the product's limited deployment footprint and the unresolved authentication ambiguity.

An attacker interacts with the Alo Suite '/Requests/userInvitation' endpoint and intercepts/modifies the parameters of a user-invitation request so that the newly invited account is assigned administrative privileges, which the server fails to validate. The result is unauthorized privilege escalation granting full administrative control of the application. No PoC or exploit code is referenced in the available sources; exploitation is low-complexity over the network per the CVSS vector.