CVE-2026-12686
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
An authenticated user can manipulate a company ID parameter in a POST request to the backend to gain unauthorized access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user's session, resulting in a cross-tenant authorization bypass.
Risk Assessment
Successful exploitation allows unauthorized access to sensitive customer information, including billing data, and may enable unauthorized modification of third-party data, posing a significant risk to data confidentiality and integrity.
Recommendation
Immediately implement a mechanism to verify that the company ID in the POST request belongs to the authenticated user, and conduct a code audit to eliminate similar cross-tenant authorization vulnerabilities.
Original NVD description (English source)
An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.