PT-2026-146987

CVE-2026-129129

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AiSOC versions 12.1.0 through 23.2.9

Description Missing authentication allows unauthenticated attackers to query the enrichment service via Next.js console rewrite routes. By sending requests to the endpoints '/api/v1/enrichment/lookup' or '/api/v1/enrichment/bulk', attackers can retrieve threat-intelligence results. Additionally, setting the force variable to true allows the consumption of commercial provider API quotas.

Recommendations Update AiSOC to version 23.3.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Beenu Arora

Narosec

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function