EUVD-2026-40954
GHSA-59mp-p3m2-6wr7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-accessible endpoint; impact limited to low confidentiality via account existence disclosure, with no integrity or availability effect and no scope change.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and email addresses.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid usernames and email addresses by observing distinguishable application responses from the password reset and username reminder endpoints. The CWE-204 Observable Response Discrepancy root cause means account existence is leaked through differential error messages, status codes, or redirect behavior - classic reconnaissance fodder for follow-on credential stuffing or targeted phishing against compliance personnel. No public exploit code has been identified and no CISA KEV listing exists; however, vendor contact was unsuccessful, leaving patch status unresolved and version scope uncertain beyond the confirmed 25.3.3.1 release.
Technical ContextAI
MCO (MyComplianceOffice) is a SaaS compliance management platform (CPE: cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*) used in regulated industries to manage policy, training, and employee compliance workflows. The vulnerability is classified under CWE-204 (Observable Response Discrepancy), a design-level flaw where authentication-adjacent endpoints - specifically username reminder and password reset flows - emit detectably different responses depending on whether the supplied email or username corresponds to a registered account. This is a well-understood class of information disclosure: the application intends to help legitimate users recover access, but the asymmetric feedback loop (e.g., 'Email not found' vs. 'Reset link sent' vs. differing HTTP status codes) transforms a recovery feature into an account oracle. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms the endpoints are network-reachable with no complexity barriers, attack requirements, or privilege prerequisites.
RemediationAI
No vendor-released patch has been identified at time of analysis - CERT-PL explicitly noted that vendor contact attempts were unsuccessful, and no fix version is available from the references provided. Organizations running MCO 25.3.3.1 (or any version) should apply the following compensating controls: rate-limit and require CAPTCHA on the password reset and username reminder endpoints via a WAF or reverse proxy rule to increase the cost of automated enumeration (trade-off: adds friction for legitimate users recovering access); configure alert rules on bulk sequential requests to these endpoints to detect enumeration campaigns in progress; and restrict access to these endpoints by source IP if only a known employee population requires them (trade-off: breaks self-service for remote or mobile users). Organizations should escalate directly to MyComplianceOffice support via https://mco.mycomplianceoffice.com/ and monitor the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-53902 for patch availability updates.
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve tradi
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today