Loading story…
A critical improper authorization vulnerability tracked as CVE-2026-12686 has been disclosed in Adiss’s Biloop platform. According to the advisory published by INCIBE-CERT, the flaw allows an authenticated user to alter a company ID parameter in a backend POST request because the application fails to verify that the requested company belongs to the user’s active session within the same subdomain environment.
Successful exploitation can enable cross-tenant access to other customers’ data, exposing sensitive information such as billing records and potentially allowing unauthorized modification of third-party data. The issue is described as remotely exploitable and carries a CVSS 4.0 score of 9.3, placing it in the critical severity range.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-12686 was published as a critical vulnerability affecting Adiss's Biloop. The entry assigns a CVSS 4.0 base score of 9.3 and notes the issue is remotely exploitable and can expose billing and other sensitive customer information.
INCIBE-CERT published an advisory describing an incorrect authorization vulnerability in Adiss's Biloop. The flaw allows an authenticated user to manipulate a company ID parameter and gain cross-tenant access within the same subdomain environment, exposing or modifying third-party customer data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several newly disclosed **Admidio** vulnerabilities allow unauthorized or improperly authorized state-changing actions in core modules handling roles, documents, and forums. One flaw in `modules/groups-roles/groups_roles.php` is a **CSRF** issue that can let an attacker trick an authenticated user with `rol_assign_roles` privileges into activating, deactivating, or deleting organizational roles because the server does not properly enforce anti-CSRF validation for some sensitive requests. Additional Admidio issues stem from **missing authorization checks** on destructive actions, allowing operations to proceed after insufficient validation. In the documents module, `modules/documents-files.php` uses read-access checks such as `getFolderForDownload()` and `getFileForDownload()` before executing `folder_delete` and `file_delete`, which can let any user who can view a file or folder delete it; in public-mode configurations, that can extend to **unauthenticated deletion** of public content. In the forum module, `modules/forum.php` validates a CSRF token for `topic_delete` and `post_delete` actions but fails to verify whether the requester is actually authorized to delete the targeted content, enabling arbitrary forum post or topic deletion. A separate disclosure affecting **Campus Educativa** describes an **IDOR** at `/administracion/admin_usuarios.cgi` that exposes enrolled-user data through brute-forced course IDs, but that is a different product and incident and should be treated separately.
Jun 29, 2026
OpenBMB ChatDev through version **2.2.0** is affected by **`CVE-2026-58166`**, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the `POST` uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into `save_upload_file` without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations. The issue is rated **CVSS 3.1 9.1 (Critical)**, with a listed **CVSS 4.0 8.8 (High)**, and is considered remotely exploitable without authentication. The flaw was fixed in commit **`4fd4da6`**, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Jul 1, 2026
A high-severity vulnerability tracked as **`CVE-2026-33120`** was disclosed in Microsoft SQL Server, where an untrusted pointer dereference can allow **remote code execution** by an authenticated attacker with low privileges. The flaw is rated **CVSS 8.8** and can be exploited over the network without user interaction, with potential impact across confidentiality, integrity, and availability. Successful exploitation could lead to **system-level compromise** of the database server, enabling database theft, credential dumping, lateral movement, and possible tenant-isolation escape in shared or multi-tenant deployments. A separate disclosure, **`CVE-2026-40155`**, affects the **Auth0 Next.js SDK** and stems from a race condition in the DPoP proxy fetcher that can expose one user’s session identifiers, access tokens, or API response data to another concurrent authenticated user. The issue is rated **CVSS 5.4** and is considered harder to exploit because it depends on precise timing, DPoP challenges, and concurrent requests reaching the application tier. Its impact is focused on **data confidentiality**, with low integrity impact, no availability impact, a low EPSS score, and no listing in CISA’s Known Exploited Vulnerabilities catalog.
Jun 29, 2026