Alo Suite CVE-2026-108060

Exploitation requires a valid authenticated Alo Suite account with access to the worker-creation functionality (/Trabajadores/Create), where the attacker stores a JavaScript payload in the 'Nombre' field; the input is insufficiently sanitized/encoded. The payload only fires when a different user subsequently views the affected delivery-note record, so exploitation is gated by (1) prior authentication at low privilege (PR:L) and (2) required victim interaction - a second user actually opening the record (UI:P). Impact is confined to the viewing user's session context (content alteration and actions as the victim), with no direct confidentiality, integrity, or availability impact to the underlying application itself per the vector.

This is a medium-severity issue (CVSS 4.0 base 5.1) that aligns with a 'this_month' remediation priority rather than an emergency. All signals point the same direction and are consistent: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows a network-reachable but privilege-dependent flaw that also requires a second user to passively view the malicious record, and the vulnerable-system impact metrics are all None (VC:N/VI:N/VA:N) with only low subsequent-system confidentiality and integrity impact (SC:L/SI:L). No EPSS score, no CISA KEV listing, and no POC were provided in the input, and the single reference is an INCIBE aggregate advisory. The realistic risk is that of an authenticated stored XSS: it needs an attacker who already holds a valid account and depends on a victim viewing the affected record, which makes it useful for privilege escalation or lateral session abuse within an organization rather than mass remote compromise. Treat it as a genuine but non-emergency hygiene fix; the 'this_month' label and absence of exploitation evidence argue against drop-everything urgency while the stored, cross-user nature argues against ignoring it.

An attacker with a low-privileged authenticated Alo Suite account creates or edits a worker record via /Trabajadores/Create, placing a JavaScript payload in the 'Nombre' field, which is stored without adequate sanitization. When another user - potentially a higher-privileged operator - later views the affected delivery-note record, the script executes in that victim's browser session and can alter displayed content or act in the victim's context. No public exploit was identified at time of analysis, so a payload would have to be crafted by the attacker.