CVE-2026-12686Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user’s session, resulting in a cross-tenant authorisation bypass. If this vulnerability is successfully exploited, it allows unauthorised access to sensitive customer information, including billing data, and may enable the unauthorised modification of third-party data.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-authorisation-adisss-biloop

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-07-06); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-06	2	Disclosure2
2026-07-07	1	Disclosure1

Full discourse3 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs91d
Disclosure
CVE-2026-12686 Biloop Authorisation bypass could let authenticated users manipulate company identifiers and access another company’s data in the same SaaS environment Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-07-06/TIER_2_CVE-2026-12686.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The post announces the discovery of CVE-2026-12686, describing an authorization bypass that lets authenticated users access data of other companies within the same SaaS environment, but it provides no PoC, exploit code, or patch information.
0010058
56 followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-12686 An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same s… https://www.cve.org/CVERecord?id=CVE-2026-12686 ----- Traducción: CVE-2026-12686 Un … http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-12686, outlining an authentication‑based access‑lesion flaw, but provides no evidence of proof‑of‑concept, exploit code, active exploitation, patches, or debunking.
0000032
92 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-12686 An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same s… https://www.cve.org/CVERecord?id=CVE-2026-12686
Post summary
The CVE discloses that authenticated users can manipulate a company ID parameter in POST requests to obtain unauthorized access to other companies within the same system.
00000862
57.7K followersView on X

Explore more

Back to dashboard