CVE-2026-129129: AiSOC 12.1.0 before 23.3.0 Missing Authentication via Enrichment Console Proxy Routes
Published Nov 13, 2026
·Updated
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.
Affected Software
1 affected component
AiSOC>=12.1.0<23.3.0
Event History
Nov 13, 2026
CVE Published
via MITRE·04:23 PM
Data Sourced
via MITRE·04:23 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness