EUVD-2026-40951
GHSA-4hjp-j24w-p3rr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requiring a low-privilege session only; read-only ACL data disclosure with no integrity, availability, or scope-change impact.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user via a missing authorization check on the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure web API endpoint. Confirmed by CERT-PL in version 25.3.3.1, the flaw allows low-privileged users to retrieve permission hierarchies and internal configuration details intended only for administrators. No active exploitation has been identified, no public exploit code exists, and vendor contact attempts were unsuccessful, leaving the patch timeline and full version impact unresolved.
Technical ContextAI
MCO (MyComplianceOffice) is a compliance management SaaS platform (CPE: cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*). The vulnerable endpoint /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure is a REST web API designed to return Access Control List tree structures - hierarchical data models that define role and permission assignments across the platform's administrative hierarchy. CWE-863 (Incorrect Authorization) describes a flaw where an authorization check is either absent or improperly implemented, allowing a less-privileged principal to access a resource gated for a higher-privileged role. In this case, the server processes the request from a low-privileged authenticated user without validating that the caller holds administrator-level authorization, returning sensitive ACL data including permission mappings and internal configuration details that could be leveraged to understand the platform's administrative structure.
RemediationAI
No vendor-released patch has been identified at time of analysis due to unsuccessful vendor contact attempts by CERT-PL. As a compensating control, restrict network access to the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint at the WAF or reverse proxy layer to trusted administrative source IP ranges only - note this may disrupt legitimate admin workflows if admins access from general corporate IP space. Additionally, audit existing access logs for prior unauthorized queries to this endpoint to assess historical exposure. Monitor the vendor advisory page at https://mco.mycomplianceoffice.com/ and the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-53902 for patch availability. Until patched, review and minimize the set of active low-privileged user accounts to reduce the attack surface.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today