Auth bypass in Adiss Biloop

CVE-2026-12686

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether…

Vulnerability class: IDOR (Insecure Direct Object Reference)