CVE-2026-103054 is an authorization bypass vulnerability affecting AiSOC versions >=10.0.0 and <12.0.0 in the MSSP module. The vulnerability allows authenticated users to manipulate the add_tenants_to_portfolio endpoint by submitting arbitrary tenant UUIDs, enabling them to add tenants they do not own to their portfolios. Consequently, attackers can read sensitive security-related data of these tenants without consent.

Exploitation of this vulnerability enables unauthorized access to security alerts, incidents, and posture metrics of tenants that the attacker does not own. This compromises tenant confidentiality and could lead to unauthorized disclosure of sensitive security information. The CVSS 4.0 score is 7.1 (high severity), indicating a significant risk due to network attack vector, low attack complexity, and no user interaction required.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent misuse of the add_tenants_to_portfolio endpoint and monitor for suspicious tenant additions.