Which versions of MCO are affected by CVE-2026-53902?

A privilege escalation vulnerability in MyComplianceOffice (MCO) version 25.3.3.1 allows authenticated internal users to self-assign membership to arbitrary groups, potentially granting unauthorized…

How to fix or mitigate CVE-2026-53902?

Within 24 hours: Confirm MCO version deployed and whether the vulnerable /group-membership endpoint is accessible; implement network or API gateway restrictions limiting endpoint access to authorized administrators only. Within 7 days: Audit all group membership changes in MCO logs for past 90 days to identify unauthorized additions; revoke suspicious group memberships and restrict user permissions to prevent self-service group management. Within 30 days: Contact MyComplianceOffice for patched version timeline and deploy immediately upon availability; if no patch forthcoming within 30 days, evaluate migration to alternative compliance platform or implement permanent compensating controls.

MCO CVE-2026-53902

Q: What is the CVSS score of CVE-2026-53902?

CVE-2026-53902 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40948 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-01 CERT-PL

GHSA-rgv6-j8h9-46fv

Privilege Escalation Mco Mycomplianceoffice

7.1

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable endpoint (AV:N), simple request (AC:L), needs an existing low-priv account (PR:L), no interaction; unauthorized group changes give high integrity, low confidentiality, no availability, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 13:22 vuln.today

CVE Published

Jul 01, 2026 - 11:58 cve.org

HIGH 7.1

DescriptionCVE.org

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

AnalysisAI

Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add themselves to arbitrary groups via the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint, which fails to enforce authorization on group changes. By supplying a valid group ID - obtainable through the application's own group picker API or guessable via brute force - a low-privileged account can inherit the permissions of higher-privileged groups. Reported by CERT-PL; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

MCO (MyComplianceOffice) is a governance, risk, and compliance (GRC) web application used by regulated firms to manage employee compliance obligations. The affected component is a Java servlet-backed web API - the /customer/servlet/mco/... path indicates a servlet container. The root cause is CWE-266 (Incorrect Privilege Assignment): the group-membership modification endpoint trusts a client-supplied group ID and updates the caller's membership without verifying the caller is authorized to join that group. Because group IDs can be enumerated through a legitimate sibling endpoint (/customer/servlet/mco/webapi/group/picker/groups) or inferred by brute force, the missing server-side authorization check converts an ordinary authenticated session into a vector for vertical privilege gain. The CPE cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:* confirms vendor 'mycomplianceoffice' and product 'mco', with the version wildcard reflecting that only 25.3.3.1 was confirmed while other versions remain untested.

RemediationAI

No vendor-released patch identified at time of analysis, as CERT-PL was unable to establish contact with MyComplianceOffice. Organizations should contact the vendor directly to confirm a fixed release and request server-side authorization enforcement on the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. As compensating controls until a fix exists: restrict or monitor access to the group-membership and group picker (/customer/servlet/mco/webapi/group/picker/groups) endpoints at a reverse proxy or WAF so group-modification requests from non-administrative sessions are blocked (side effect: legitimate self-service group changes, if any, would break); enable and alert on audit logging of group-membership changes to detect anomalous self-additions to privileged groups (side effect: increased log volume); and periodically review current memberships for unauthorized entries. Reference the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-53902.