The vulnerability is an inadequate authorization flaw in Alosuite’s user invitation endpoint. The /Requests/userInvitation route fails to validate privilege assignments, enabling an attacker to alter invitation parameters. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can give administrative rights to a newly invited user, resulting in full administrative control of the application. This is a classic improper access control issue that can compromise the entire system’s confidentiality and integrity.

The affected vendor is AM System, specifically the Alosuite application. The vulnerable release is version 25_09_15.03_35, as identified by the CPE string. The vendor has fixed the flaw in version 26_04_15.03_10, which was released in April 2026.

The CVSS score of 8.6 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote: an attacker can manipulate the invitation request over the network, without prior authentication. Once exploited, the attacker gains administrative privileges, enabling complete compromise of the system.