EUVD-2026-115797
GHSA-fh32-xrpw-f94g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target account identifier
-
ExploitScript repeated POST to /Account/resetPwd
-
ExecutionServer sends unthrottled reset emails
-
ImpactEmail flood exhausts inbox and mail resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Alo Suite password-recovery feature be reachable and that the '/Account/resetPwd' endpoint accept reset requests without rate or frequency limits - the default behavior described. No authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N), and the attacker must know or enumerate a valid target account identifier. The practical limiting factors are narrow: impact is confined to availability/resource abuse and email flooding (no data exposure or code execution), and effectiveness depends on reachability of the endpoint and absence of any external mitigations such as a WAF or upstream mail rate controls. |
| Impact | This is a genuine but moderate-severity availability issue, not a high-impact priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, but impact is limited to VA:L (low availability) with no confidentiality or integrity impact - consistent with CWE-770 (missing request limits) and an email-flooding/resource-abuse outcome rather than system compromise. The vuln.today decision label is 'this_month', signaling a planned-remediation priority rather than act_now/emergency. There is no CISA KEV listing and no EPSS score supplied, so widespread automated exploitation is not evidenced; no public exploit or PoC reference is present in the input either. The main real-world concerns are secondary: an email flood can facilitate inbox-based social engineering, mail-reputation damage, and resource consumption, and the lack of anti-automation controls on password recovery can support credential-related attacks against the recovery service. Net: a legitimate hardening gap worth scheduled remediation, not a critical, drop-everything vulnerability. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker repeatedly scripts calls to the '/Account/resetPwd' endpoint for a target user's account, generating an unlimited flood of password-reset emails to that user and consuming application and mail-infrastructure resources. No public exploit identified at time of analysis, though the attack requires only trivial HTTP automation given AV:N/AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Alo Suite's password recovery endpoint '/Account/resetPwd' lacks rate and frequency limits, so remote attackers can repeatedly trigger unlimited reset emails to a single account, flooding the user's inbox and consuming application and mail infrastructure resources (CWE-770). The flaw affects Alo Suite installations exposing the password-recovery feature (CPE cpe:2.3:a:am_system:alo_suite), requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and is assessed as a moderate-severity availability issue with limited impact (CVSS:3.1 A:L; no confidentiality or integrity effect). The trigger is straightforward endpoint abuse per the available sources; no public exploit code or active exploitation is confirmed, though the vendor advisory from INCIBE is available.
RemediationAI
No vendor-released patch version is identified in the available data; consult the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite) for the vendor's fix guidance and apply any update it lists. Until a fix is applied, compensate by enforcing rate limiting and CAPTCHA or bot-detection on the '/Account/resetPwd' endpoint at the reverse proxy or WAF, with the trade-off that aggressive limits may delay legitimate reset requests; add per-account and per-IP throttling plus deduplication or cooldown windows on reset emails, accepting that some users may wait longer for a reset message; and apply upstream mail rate controls and monitoring/alerting on reset-email volume to cap infrastructure consumption, recognizing that this reduces but does not eliminate abuse of the recovery mechanism.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an allocation-of-resources-without-limits weakness (CWE-770) in Alo Suite, an application from AM Systems, affecting the '/Account/resetPwd' endpoint of its password recovery workflow. Per the advisory, the endpoint does not enforce adequate restrictions on the number or frequency of password reset requests for a single account, allowing automated, repeated calls that generate unlimited reset emails. CPE data (cpe:2.3:a:am_system:alo_suite) identifies Alo Suite as the affected product but does not pin specific versions; the underlying technology stack is not described in the supplied sources, and the exact request-handling mechanics beyond the missing rate/frequency controls are not detailed. Impact is confined to availability and resource consumption (email flooding and abuse of the recovery mechanism), with no exposure of data or code execution indicated.
Know when Alo Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity endpoint abuse (AV:N/AC:L/PR:N/UI:N); no confidentiality or integrity impact, only low availability/resource impact (A:L).
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Alo Suite's user-invitation workflow can assign administrative privileges to a newly invited account because the '/Reque
Unauthenticated information disclosure in AM Systems Alo Suite allows remote attackers to read records belonging to othe
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre'
Stored cross-site scripting in AM System Alo Suite's delivery-note functionality allows an authenticated user to persist
Stored cross-site scripting in Alo Suite (AM System) lets an authenticated user with access to the mail-template editor
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre'
Stored cross-site scripting (CWE-79) in AM System Alo Suite lets an authenticated, low-privileged user persist JavaScrip
Stored cross-site scripting in Alo Suite lets an authenticated user with access to /Inmuebles/Create persist JavaScript
Stored cross-site scripting (CWE-79) in AM System's Alo Suite lets an authenticated low-privilege user plant JavaScript
Stored cross-site scripting in AM System's Alo Suite lets authenticated users with access to the current-accounts creati
Stored cross-site scripting in AM Systems Alo Suite lets an authenticated user with write access to the 'Codigo' field o
Stored cross-site scripting in Alo Suite lets authenticated users with article or delivery-note creation rights inject J
Exploit-DB