EUVD-2026-40949
GHSA-h63w-8j45-g3cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring authentication (PR:L); impact is limited to confidentiality of documents with no integrity or availability consequence and no scope change.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other users by providing a valid document ID. Although exploitation requires guessing the identifier, predictable ID patterns enable feasible enumeration, leading to unauthorized disclosure of sensitive information.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AnalysisAI
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve trading document PDFs belonging to other customers by manipulating a user-supplied document identifier at the fetchPdfStatement API endpoint. The application performs no ownership or authorization check beyond confirming the user is logged in, enabling horizontal privilege escalation across customer accounts. No public exploit code or active exploitation has been identified at time of analysis, but predictable document ID patterns make automated enumeration feasible, raising real-world risk in financial compliance environments where trading statements contain sensitive regulatory and transactional data.
Technical ContextAI
MCO is a compliance management SaaS platform operated by MyComplianceOffice (cpe:2.3:a:mycomplianceoffice:mco:*:*:*:*:*:*:*:*) serving financial sector organizations. The vulnerable endpoint is a REST API path - /customer/servlet/mco/webapi/trading-document/fetchPdfStatement - that returns PDF trading statements by document identifier. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the application resolves resource access based solely on a caller-supplied key rather than binding that key to the authenticated user's identity at query time. This omits the authorization layer entirely, reducing access control to simple knowledge of an identifier. The description notes identifier patterns are predictable, meaning enumeration is not merely theoretical - sequential or structured ID schemes allow an attacker to systematically harvest cross-customer documents without brute-forcing a large keyspace.
RemediationAI
No vendor-released patch has been identified at time of analysis - vendor contact attempts by CERT-PL were unsuccessful. Pending a vendor fix, organizations should implement compensating controls at the network or application layer. WAF rules or API gateway policies can restrict access to /customer/servlet/mco/webapi/trading-document/fetchPdfStatement to only the authenticated user's own session context where technically feasible. Rate limiting on this endpoint will slow enumeration attacks - note this does not prevent exploitation but raises the attacker's time cost and increases detectability. Audit logs should be reviewed for anomalous document ID access patterns, particularly sequential ID traversal or access to IDs far outside the requesting user's own document range. Organizations should escalate through their MCO account contacts to demand vendor acknowledgment and a patch timeline. See the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-53902 for additional disclosure context (note: that URL references sibling CVE-2026-53902 and may cover related findings).
Privilege escalation in MyComplianceOffice (MCO) compliance platform version 25.3.3.1 lets an authenticated user add the
User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted us
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to u
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-pri
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant mali
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today