CVE-2026-103054: AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the addtenantstoportfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AiSOCto a version that resolves this vulnerability.Fixed in 12.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
AiSOC deployments running a version before 12.0.0 are affected if the MSSP module is in use. The issue concerns portfolios owned by authenticated users and unclaimed tenants.
What access does an attacker need to exploit it?
An attacker needs an authenticated AiSOC account and the ability to submit requests to the add_tenants_to_portfolio endpoint. No user interaction is required.
What information can be accessed after exploitation?
An attacker can add arbitrary unclaimed tenant UUIDs to a portfolio they own, then read those tenants' security alerts, incidents, and posture metrics.
How can I determine whether unauthorized access may have occurred?
Review portfolio tenant additions made through the add_tenants_to_portfolio endpoint, particularly for tenant UUIDs added by users who should not have been authorized to manage those tenants. Investigate portfolios containing unexpected unclaimed tenants.
What is the available remediation?
Upgrade AiSOC to version 12.0.0 or later. The provided release information identifies version 12.0.0 as the fixed release.