EUVD-2026-40138
GHSA-2mvr-4jqv-324m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires spectator-role credentials (PR:L, AV:N); no confidentiality impact, only limited integrity and availability impact on automation workflows.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
AnalysisAI
Authorization bypass in Mythic C2 framework before 3.4.0.60 allows authenticated spectator-role users to perform write operations against the eventing_import_automatic_webhook endpoint, which is incorrectly registered under spectator-permitted middleware. Spectator accounts - intended to be read-only observers of red team operations - can exploit this misconfiguration to create and delete automation workflows and EventGroups, effectively escalating their privilege within an active operation. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.4.0.60.
Technical ContextAI
Mythic is an open-source command-and-control (C2) framework designed for adversary simulation and red team operations, maintained at github.com/its-a-feature/Mythic. It implements a role-based access control model with distinct roles including operators and spectators, where spectators are meant to have read-only visibility into operations. The root cause is CWE-863 (Incorrect Authorization): the endpoint eventing_import_automatic_webhook - which handles creation and deletion of automation workflows (EventGroups) - was registered under middleware that permits spectator-role requests, rather than under the middleware enforcing operator or admin privileges. This is a middleware routing misconfiguration rather than a logic flaw in the endpoint itself, meaning the endpoint performs write operations correctly but is reachable by an insufficiently privileged role. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N confirms network-accessible exploitation with low-privilege credentials and no attack-path complexity.
RemediationAI
Upgrade Mythic to version 3.4.0.60 or later; this is the primary and recommended remediation. The fix is implemented in commit 82648e8241b800a32e1882afc310e7316d98ebaa (https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa), which corrects the middleware registration for the eventing_import_automatic_webhook endpoint. Prior to patching, teams should audit all spectator-role accounts and, if operationally feasible, revoke or suspend spectator accounts until the upgrade is applied - this eliminates the PR:L prerequisite entirely at the cost of losing read-only observability for those users. Additionally, review existing EventGroups and automation workflows for unexpected or unauthorized entries that could indicate prior exploitation. The VulnCheck advisory (https://www.vulncheck.com/advisories/mythic-unauthorized-automation-workflow-modification-via-eventing-import-automatic-webhook-endpoint) and GitHub issue #565 (https://github.com/its-a-feature/Mythic/issues/565) provide additional context.
Cross-operation information disclosure in Mythic C2 framework versions before 3.4.0.60 allows any authenticated operator
Cross-operation authorization bypass in Mythic C2 framework before 3.4.0.60 exposes encryption keys and C2 profile confi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today