{"metadata": {"vulnerability": "CVE-2026-12686", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-06-19T08:38:05.732Z", "date_only": false, "value": "2026-06-19T08:38:05.732Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-12686", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-06T08:46:00Z", "date_only": false, "value": "2026-07-06T08:46:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-12686", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T08:48:54.613Z", "date_only": false, "value": "2026-07-06T08:48:54.613Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-12686", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T08:48:54.613Z", "date_only": false, "value": "2026-07-06T08:48:54.613Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-12686", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-06T10:30:28.977Z", "date_only": false, "value": "2026-07-06T10:30:28.977091Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116872565768512647", "record": "cve-2026-12686", "field": "creation_timestamp", "uuid": "ee88c45c-006d-4aff-8f58-a322a3fc1aaa", "content": "Adiss Biloop v6.1.1: CRITICAL CVE-2026-12686 enables authenticated users to bypass authorization via manipulated company ID, exposing cross-tenant data. Monitor logs and limit exposure while awaiting patch. https://radar.offseq.com/threat/cve-2026-12686-cwe-639-authorization-bypass-throug-3166bcbbfec7c2c9 #OffSeq #CVE202612686 #infosec #vuln", "url": "https://infosec.exchange/users/offseq/statuses/116872565768512647"}, {"timestamp": "2026-07-06T10:30:30.845Z", "date_only": false, "value": "2026-07-06T10:30:30.845383Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpxv3qz2ph2g", "record": "cve-2026-12686", "field": "creation_timestamp", "uuid": "2d076412-4c69-48af-8fe1-df13f78fe9e5", "content": "CRITICAL vuln in Adiss Biloop v6.1.1: Authenticated users can access and modify other tenants\u2019 data via company ID parameter manipulation. Review and tighten access controls. https://radar.offseq.com/threat/cve-2026-12686-cwe-639-authorization-bypass-throug-3166bcbbfec7c2c9 #OffSeq #CVE202612686 ...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mpxv3qz2ph2g"}, {"timestamp": "2026-07-06T11:16:26Z", "date_only": false, "value": "2026-07-06T11:16:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-67J5-PJ6C-M82P", "record": "GHSA-67J5-PJ6C-M82P", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-06T11:16:26.797Z", "date_only": false, "value": "2026-07-06T11:16:26.797", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-12686", "record": "FKIE_CVE-2026-12686", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T12:08:04.530Z", "date_only": false, "value": "2026-07-06T12:08:04.530185Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpy2k7rycx2i", "record": "CVE-2026-12686", "field": "creation_timestamp", "uuid": "ea396b7e-fb4c-4c05-90a4-756babfebf53", "content": "CVE-2026-12686\nAdobe Commerce does not properly check user access to company data, which means an authenticated user could see or change sensitive information from other companies hosted on the same website. This could lead\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mpy2k7rycx2i"}, {"timestamp": "2026-07-06T12:12:06.065Z", "date_only": false, "value": "2026-07-06T12:12:06.065584Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2rdjfhx2q", "record": "CVE-2026-12686", "field": "creation_timestamp", "uuid": "b25b96d0-db31-43e0-aa23-11733c5246e9", "content": "CVE-2026-12686 - Incorrect authorisation in Adiss\u2019s Biloop\nCVE ID : CVE-2026-12686\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised acce...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2rdjfhx2q"}, {"timestamp": "2026-07-06T12:31:30Z", "date_only": false, "value": "2026-07-06T12:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-67J5-PJ6C-M82P", "record": "GHSA-67J5-PJ6C-M82P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-06T12:31:30Z", "date_only": false, "value": "2026-07-06T12:31:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-67J5-PJ6C-M82P", "record": "GHSA-67J5-PJ6C-M82P", "field": "modified"}, {"timestamp": "2026-07-06T12:50:50.832Z", "date_only": false, "value": "2026-07-06T12:50:50.832426Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-12686", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-06T12:50:50.832Z", "date_only": false, "value": "2026-07-06T12:50:50.832426Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-12686", "record": "FKIE_CVE-2026-12686", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-06T12:50:57.194Z", "date_only": false, "value": "2026-07-06T12:50:57.194Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-12686", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-06T12:50:57.194Z", "date_only": false, "value": "2026-07-06T12:50:57.194Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-12686", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-25T15:10:00.147Z", "date_only": false, "value": "2026-10-25T15:10:00.147", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-12686", "record": "FKIE_CVE-2026-12686", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T18:02:09.344Z", "anchors": {"origin": {"timestamp": "2026-07-06T08:46:00Z", "date_only": false, "value": "2026-07-06T08:46:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-12686", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-06T08:46:00Z", "date_only": false, "value": "2026-07-06T08:46:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-12686", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 10142169.344834, "hours": 2817.269262453889, "days": 117.38621926891203, "min_seconds": 10142169.344834, "max_seconds": 10142169.344834, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-06T08:46:00Z", "date_only": false, "value": "2026-07-06T08:46:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-12686", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T18:02:09.344Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}