MCO CVE-2026-53902

Requires a valid authenticated MCO account (CVSS PR:L) that can reach the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint over the network (AV:N), plus a valid target group ID. That group ID is obtainable through the application's own /customer/servlet/mco/webapi/group/picker/groups endpoint when the user has the necessary permissions, or otherwise inferred through brute-force enumeration. No user interaction, no non-default configuration, and no elevated privileges are required; the primary limiting factors are that the attacker must already hold a working low-privileged session and must know or guess a privileged group's ID. Confirmed only against MCO version 25.3.3.1.

The vendor CVSS 4.0 score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N, indicating a network-reachable, low-complexity attack requiring low privileges (an existing authenticated account) and no user interaction, yielding high integrity impact (unauthorized permission changes) with only low confidentiality and no availability impact - consistent with privilege escalation rather than data destruction. No EPSS score, KEV entry, or SSVC decision was supplied, so probabilistic and government-triage signals are unavailable, and there is no public exploit identified at time of analysis. Realistic priority is moderate-to-high for organizations running MCO because the prerequisite (any valid low-privileged account) is easily met by insiders or attackers who have phished a single credential, and the group-ID enumeration path is documented within the app itself. Key caveat: affected-version data is incomplete - only 25.3.3.1 is confirmed and the vendor was unreachable, so defenders cannot rely on a clean 'fixed version' boundary and should treat all deployed versions as potentially vulnerable until tested.

A low-privileged employee, or an attacker who has compromised one standard user credential, logs into MCO, calls the group picker endpoint to list valid group IDs, then sends a crafted request to the group-membership endpoint adding their own account to a privileged group. With the missing authorization check the change succeeds and the attacker gains elevated permissions without admin approval. No public exploit is identified, but per the CVSS vector the attack is low-complexity and needs only standard authenticated access.