Which versions of Biloop are affected by EUVD-2026-41860?

Adiss Biloop contains a critical cross-tenant data access vulnerability (CVE-2026-12686, CVSS 9.3) enabling authenticated users to access and modify sensitive customer data across different company…. A patch is available.

How to fix or mitigate EUVD-2026-41860?

24 hours: Identify all Adiss Biloop deployments and quantify number of affected customer tenants; implement network-layer access restrictions to backend POST endpoints. 7 days: Obtain and apply vendor-released patch (patch available per vendor advisory) to all instances; conduct functional testing in staging environment. 30 days: Execute forensic audit of authorization logs for cross-tenant access events; notify affected customers and document incident response per regulatory obligations.

Biloop EUVD-2026-41860

Q: What is the CVSS score of EUVD-2026-41860?

EUVD-2026-41860 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-12686 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-06 INCIBE

GHSA-67j5-pj6c-m82p

Authentication Bypass Biloop

9.3

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable authenticated (PR:L) IDOR with low complexity; scope changed (S:C) since one tenant's session breaches another tenant's data, high C/I and low A.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 11:01 vuln.today

DescriptionCVE.org

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.

AnalysisAI

Cross-tenant authorization bypass in Adiss Biloop allows an authenticated user to manipulate the company ID parameter in a backend POST request and access or modify data belonging to other companies (tenants) hosted in the same subdomain environment. The flaw exposes sensitive customer information including billing data and permits unauthorized modification of third-party records. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 (Critical) and low privilege requirement make this a high-priority issue for multi-tenant Biloop deployments.

Technical ContextAI

Biloop is a business/accounting management SaaS platform by Adiss (cpe:2.3:a:adiss:biloop) that hosts multiple companies (tenants) within a shared subdomain environment. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), an Insecure Direct Object Reference (IDOR): the backend accepts a client-supplied company ID in POST requests but fails to validate that the identified company belongs to the authenticated user's session. Because tenant isolation is enforced only by a mutable request parameter rather than server-side session-to-tenant binding, any authenticated user can pivot the object key to another tenant's identifier and the application authorizes the operation.

RemediationAI

Patch available per vendor advisory - apply the fix from Adiss/Biloop as coordinated through INCIBE-CERT (https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-authorisation-adisss-biloop); no exact fixed version string was provided in the source data, so confirm the target patched build directly with the vendor. As Biloop is a vendor-hosted SaaS platform, remediation is primarily the provider's responsibility to deploy server-side authorization that binds the company ID to the authenticated session on every backend request. Until confirmed patched, compensating controls for operators include restricting or disabling self-service/trial account creation to limit who can obtain an authenticated foothold, enabling and reviewing backend access logs for anomalous company-ID values in POST requests (cross-tenant enumeration patterns), and rate-limiting or alerting on requests where the submitted company ID differs from the session's provisioned tenant. Note the trade-off that disabling self-service signup impacts legitimate onboarding, and log-based detection is reactive rather than preventive.