PT-2026-55915 · Adiss · Biloop

Jean-Michel Junod · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-12686

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated user can perform a cross-tenant authorization bypass by manipulating a company ID parameter in a POST request to the backend. The application fails to properly verify if the requested company ID is associated with the authenticated user's session. This flaw allows unauthorized access to sensitive customer information, such as billing data, and may enable the unauthorized modification of third-party data within the same subdomain environment. The vulnerable parameter is company ID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-12686

Affected Products

Biloop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-12686 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/incorrect-authorisation-adisss-biloop · Patch
• https://twitter.com/CVEnew/status/2074072089175482804 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074073682314469452 · Twitter Post