CVE-2026-129129
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.
References
- https://github.com/beenuar/AiSOC/blob/4d8790e21489bffdb33bdbd1ea9ea712899efaf9/apps/web/next.config.js#L305-L310
- https://github.com/beenuar/AiSOC/commit/3a853d16b09a4c59fb4fc3fbe20938bb4c306be7
- https://github.com/beenuar/AiSOC/pull/1844
- https://github.com/beenuar/AiSOC/releases/tag/v23.3.0
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-qf6m-hgwv-65f9