Advancity Alms Cloud
Monthly
Advancity ALMS Cloud (Caz Informatics Services Trade Inc.) fails to enforce proper access-control lists, letting an authenticated low-privilege user reach functionality and data that should be restricted to higher-privileged roles. Exploitation requires a valid session on a tenant (CVSS PR:L) but no user interaction, and all deployments up to and including the 2026-10-08 build are affected; the resulting impact is confidentiality-only (C:H/I:N/A:N), enabling unauthorized data disclosure rather than modification or disruption. No public exploit code was identified at time of analysis, and because the vendor did not respond to the coordinated disclosure, no fixed version has been published.
Advancity ALMS Cloud (Caz Informatics Services Trade Inc.) fails to enforce proper access-control lists, letting an authenticated low-privilege user reach functionality and data that should be restricted to higher-privileged roles. Exploitation requires a valid session on a tenant (CVSS PR:L) but no user interaction, and all deployments up to and including the 2026-10-08 build are affected; the resulting impact is confidentiality-only (C:H/I:N/A:N), enabling unauthorized data disclosure rather than modification or disruption. No public exploit code was identified at time of analysis, and because the vendor did not respond to the coordinated disclosure, no fixed version has been published.