EUVD-2026-40950
GHSA-4p9c-w7qw-q5pq
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth, but AC:H for the security question prerequisite; impact is solely low availability with no confidentiality or integrity loss.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset process and continuously invalidate credentials, effectively locking the victim out of their account. Answering security questions has a limited number of tries which lowers the risk of this vulnerability.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted user out of their account by repeatedly triggering password resets. MCO's reset mechanism invalidates all previously set passwords and temporary credentials on every reset cycle, and imposes no rate limit on how frequently resets can be initiated - so once an attacker supplies the victim's email and a valid security question answer, they can sustain the lockout indefinitely. No public exploit has been identified at time of analysis, and active exploitation is not confirmed, but the attack is conceptually simple and requires no authentication beyond the security question hurdle.
Technical ContextAI
MCO (MyComplianceOffice) is a compliance management SaaS platform, identified by CPE cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*. The root cause maps to CWE-307: Improper Restriction of Excessive Authentication Attempts, applied here to the password reset workflow rather than login itself. The implementation flaw is twofold: first, each password reset invalidates not only the current password but also any active temporary credential issued by prior resets, meaning no fallback credential survives; second, there is no throttle, cooldown, or abuse detection on the reset endpoint itself. The security question mechanism does impose a finite retry limit on answering the question, which introduces a meaningful - though not insurmountable - prerequisite. The CVSS 4.0 vector (AV:N/AC:H) reflects this: network-accessible but with high complexity due to the security question requirement.
RemediationAI
No vendor-released patch has been identified at time of analysis - vendor contact attempts by CERT-PL were unsuccessful, and no advisory has been issued. Organizations using MCO should consider the following specific compensating controls: (1) Disable or remove security question-based password reset if the platform permits alternative recovery methods, eliminating the attacker's entry point; the trade-off is reduced self-service recovery for legitimate users. (2) Enforce multi-factor authentication on all accounts so that even if a password is invalidated, account access is not solely dependent on password state - however, this does not prevent the lockout if MFA enrollment itself depends on a working password. (3) Monitor account activity logs for abnormal patterns of password reset requests targeting the same email addresses, and alert or temporarily suspend reset capability for accounts showing repeated resets within a short window. (4) Evaluate whether account support workflows can detect and remediate targeted lockouts quickly, reducing attacker dwell impact. Full details of the disclosure are available at https://cert.pl/en/posts/2026/07/CVE-2026-53902.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today