High severity · published Sep 30, 2026
CVE-2026-103054
AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AiSOC · beenuar
10.0.0 before 12.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103054
vendor-advisory
https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
patch
https://github.com/beenuar/AiSOC/commit/151264a8b846db55099e5e0f4d76c388e8df4a92
release-notes
https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
technical-description
https://github.com/beenuar/AiSOC/blob/v11.2.0/services/api/app/api/v1/endpoints/mssp.py#L1073-L1110
third-party-advisory
https://www.vulncheck.com/advisories/aisoc-10.0.0-before-12.0.0-unauthorized-tenant-access-via-mssp
More from AiSOC
9.0
CVE-2026-103056
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
7.5
CVE-2026-103055
AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret
5.4
CVE-2026-103053
AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API
4.3
CVE-2026-103057
AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints