Alo Suite EUVD-2026-115795

No special conditions - remote unauthenticated exploitation against the /Companies/Edit/{id} endpoint of AM Systems Alo Suite; the attacker only needs to modify the object identifier in the request (PR:N/UI:N/AC:L). The practical limits are scope and impact rather than access: the flaw yields read-only unauthorized disclosure (VI:N/VA:N), its value depends on identifiers being enumerable/predictable, and it requires network reachability to the application. No authentication, user interaction, or non-default configuration is indicated by the available sources.

This is a moderate-severity information-disclosure flaw (CWE-639, IDOR) whose signals are internally consistent but point to a measured rather than urgent priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9 and indicates network-reachable, low-complexity, unauthenticated access (PR:N) with only low confidentiality impact and no integrity or availability impact - matching the description, which states unauthenticated remote attackers can enumerate identifiers at /Companies/Edit/{id} and read other companies' or users' data. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit is referenced (the only reference is the INCIBE vendor advisory), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with a real-but-non-critical issue: trivially exploitable in principle (no auth, no interaction) but bounded to read-only disclosure of limited data in a niche product. The main uncertainty is the true sensitivity and volume of data exposed - CVSS rates confidentiality as Low, but IDOR over an enumerable company/user object space can aggregate into a larger breach; verify the actual data classes returned with the vendor.

A remote, unauthenticated attacker sends requests to the /Companies/Edit/{id} endpoint while incrementing or substituting the {id} value. Because authorization is not enforced per object, the application returns records belonging to other companies or users, letting the attacker iterate through valid identifiers and harvest restricted application data. No public exploit code is referenced, but exploitation requires only a browser or scripted HTTP client given AV:N/AC:L/PR:N/UI:N.