by Kastro
Paper/Archive/CVE-2026-12686

CVE-2026-12686

Adiss Biloop — Incorrect authorisation in Adiss’s Biloop

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
34
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 31.2.312 × 206.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.

Affected

ProductAffectedFixed inSource
Biloop6.1.1–CNA

Scores by source

INCIBE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchincibe.es/en/incibe-cert/notices/aviso/incorrect-authorisation-adisss-biloop