CVE-2026-103054
7.1 HIGHpublic exploit availablePublished 2026-09-30 · Updated 2026-09-30
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/api/app/api/v1/endpoints/mssp.py#L1073-L1110
- https://github.com/beenuar/AiSOC/commit/151264a8b846db55099e5e0f4d76c388e8df4a92
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
All references
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/api/app/api/v1/endpoints/mssp.py#L1073-L1110
- https://github.com/beenuar/AiSOC/commit/151264a8b846db55099e5e0f4d76c388e8df4a92
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
- https://www.vulncheck.com/advisories/aisoc-10.0.0-before-12.0.0-unauthorized-tenant-access-via-mssp
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-71420PoC
- UNSCOREDCVE-2026-100177PoC
- MEDIUMCVE-2026-100531PoC
- LOWCVE-2026-100534PoC
- HIGHCVE-2026-100579PoC
- MEDIUMCVE-2026-100609PoC
- HIGHCVE-2026-100610PoC
- HIGHCVE-2026-100612PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.