PT-2026-102964 · Aisoc · Aisoc
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AiSOC versions prior to 12.0.0
Description
An authorization bypass exists in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. By submitting tenant UUIDs via the 'add tenants to portfolio' endpoint, attackers can claim unclaimed tenants to access security alerts, incidents, and posture metrics without consent. The
tenant UUID variable is used to identify the target tenant during this process.Recommendations
Update AiSOC to version 12.0.0 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aisoc