Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Multiple Vulnerabilities in AM System's ALO Suite

Posted date 03/11/2026
Identificador
INCIBE-2026-827
Importance
4 - High
Affected Resources

ALO Suite, version 25_09_15.03_35.

Description

INCIBE has coordinated the disclosure of 15 vulnerabilities, one high-severity and 14 medium-severity that affect AM System’s ALO Suite, a cloud-based business management software. The vulnerabilities were discovered by David Padilla Alvarado.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:

  • CVE-2026-108046: CVSS v4.0: 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-639
  • CVE-2026-108047: CVSS v4.0: 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CWE-269
  • CVE-2026-108048: CVSS v4.0: 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | CWE-770
  • CVE-2026-108049: CVSS v4.0: 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-1021
  • From CVE-2026-108050 to CVE-2026-108060: CVSS v4.0: 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79 
Solution

The manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version.

Detail
  • CVE-2026-108046: Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.
  • CVE-2026-108047: Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.
  • CVE-2026-108048: Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.
  • CVE-2026-108049: Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.
  • CVE-2026-108050 a CVE-2026-108060: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
    • CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;
    • CVE-2026-108051: Nombre in ‘/Articulos/Create’;
    • CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;
    • CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;
    • CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;
    • CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;
    • CVE-2026-108056: NombrePF in ‘/Empresas/Create’;
    • CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;
    • CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;
    • CVE-2026-108059: Observaciones in ‘/Terceros/Create’;
    • CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.
CVE
Identificador CVE Severidad Explotación Fabricante
CVE-2026-108047 Alta No AM System
CVE-2026-108046 Media No AM System
CVE-2026-108048 Media No AM System
CVE-2026-108049 Media No AM System
CVE-2026-108050 Media No AM System
CVE-2026-108051 Media No AM System
CVE-2026-108052 Media No AM System
CVE-2026-108053 Media No AM System
CVE-2026-108054 Media No AM System
CVE-2026-108055 Media No AM System
CVE-2026-108056 Media No AM System
CVE-2026-108057 Media No AM System
CVE-2026-108058 Media No AM System
CVE-2026-108059 Media No AM System
CVE-2026-108060 Media No AM System
References list
ALO Suite
AM System
Etiquetas