CVE-2026-129129

EUVD-2026-125550
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/beenuar/AiSOC/blob/4d8790e21489bffdb33bdbd1ea9ea712899efaf9/apps/web/next.config.js#L305-L310
https://github.com/beenuar/AiSOC/commit/3a853d16b09a4c59fb4fc3fbe20938bb4c306be7
https://github.com/beenuar/AiSOC/pull/1844
https://github.com/beenuar/AiSOC/releases/tag/v23.3.0
https://github.com/beenuar/AiSOC/security/advisories/GHSA-qf6m-hgwv-65f9
https://www.vulncheck.com/advisories/aisoc-12.1.0-before-23.3.0-missing-authentication-via-enrichment-console-proxy-routes