Missing authorization in Caz Informatics Advancity ALMS Cloud
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Caz Informatics Services Trade Inc. Advancity ALMS Cloud versions before v1046 are affected. A missing authorization check (CWE-862) lets users access functionality that is not properly constrained by access control lists. An authenticated remote attacker with low privileges can access data they should not reach, with high confidentiality impact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: before v1046.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Caz Informatics Services Trade Inc. | Advancity ALMS Cloud | before v1046 | v1046 | Patch available | CNA |
- Advancity ALMS Cloud VendorCaz Informatics Services Trade Inc. Affected before v1046 Fixed in v1046 Patch available CNA
Remediation
Update Advancity ALMS Cloud to v1046 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Advancity ALMS Cloud (Caz Informatics Services Trade Inc.) Fixed in v1046
Timeline
- 2026-10-08 Threatist record created from CVE-2026-12859
- 2026-10-08 Alias added: GHSA-27h6-vpmh-cv9q
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: MEDIUM → LOW
- 2026-11-04 Fix available: Caz Informatics Services Trade Inc./Advancity ALMS Cloud@v1046 · CNA
References
Sources
- CVE-2026-12859 · CVE Program
- CVE-2026-12859 · NVD
- FIRST EPSS
- GHSA-27h6-vpmh-cv9q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences