AL Suite contains a direct object reference flaw that permits an attacker to manipulate the identifier sent to the ‘/Companies/Edit/{id}’ endpoint. This vulnerability allows unauthenticated remote users to view data belonging to other companies or users, resulting in the disclosure of sensitive application information.

The flaw affects Am System's ALO Suite product. The only version explicitly listed as affected is the 25_09_15.03_35. No other versions are mentioned, and no work‑arounds are specified by the CNA.

The CVSS score of 6.9 categorizes the issue as medium severity. EPSS data is not available, and the vulnerability is not recorded in the CISA KEV catalog. The attacker can exploit the weakness remotely by issuing crafted HTTP requests to the vulnerable endpoint; unauthenticated users can enumerate valid identifiers and read restricted data. Because the exposure is to application data, the impact is primarily confidentiality. The lack of immediate patch availability increases the window of opportunity for exploitation.