Skip to main content

MyComplianceOffice MCO CVE-2026-53905

| EUVDEUVD-2026-40951 MEDIUM
Incorrect Authorization (CWE-863)
2026-07-01 CERT-PL GHSA-4hjp-j24w-p3rr
Authentication Bypass Mco
5.3
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable endpoint requiring a low-privilege session only; read-only ACL data disclosure with no integrity, availability, or scope-change impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 01, 2026 - 13:23 vuln.today
CVE Published
Jul 01, 2026 - 11:58 cve.org
MEDIUM 5.3

DescriptionCVE.org

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

AnalysisAI

MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user via a missing authorization check on the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure web API endpoint. Confirmed by CERT-PL in version 25.3.3.1, the flaw allows low-privileged users to retrieve permission hierarchies and internal configuration details intended only for administrators. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privileged MCO user credentials
Delivery
Authenticate to MCO platform
Exploit
Send GET request to admin ACL hierarchy endpoint
Execution
Receive unrestricted admin ACL tree data
Impact
Map administrator roles and permission boundaries
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session with at minimum low-privileged access to the MCO platform (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) is well-supported by the available signals: AV:N (network reachable), AC:L (no special conditions), PR:L (requires a valid low-privilege account), and VC:L (low confidentiality impact limited to ACL structure data). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated MCO user with a standard low-privileged account issues a direct HTTP request to `/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure` using their session credentials. The server returns the full administrator ACL tree without validating the caller's authorization level, exposing role hierarchies and permission mappings. …
Remediation No vendor-released patch has been identified at time of analysis due to unsuccessful vendor contact attempts by CERT-PL. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mco

View all
CVE-2026-53902 HIGH
7.1 Jul 01

Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
CVE-2026-53908 MEDIUM
6.9 Jul 01

User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid

CVE-2026-53904 MEDIUM
6.3 Jul 01

Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
CVE-2026-53909 MEDIUM
5.3 Jul 01

Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
CVE-2026-53903 MEDIUM
5.3 Jul 01

Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
CVE-2026-53906 MEDIUM
5.1 Jul 01

Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
CVE-2026-53907 MEDIUM
4.8 Jul 01

Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-49825 CRITICAL POC
9.8
CVE-2020-36948 CRITICAL POC
9.8
CVE-2025-55469 CRITICAL POC
9.8
CVE-2025-49586 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2020-5849 HIGH POC
7.5
CVE-2024-7593 CRITICAL POC
9.8

Share

CVE-2026-53905 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy