MyComplianceOffice MCO EUVD-2026-40949

Exploitation requires a valid authenticated MCO session - the CVSS 4.0 vector specifies PR:L (low privilege), confirming that unauthenticated access is not possible. Within that constraint, the attacker must supply a valid document identifier belonging to another customer at the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The description explicitly states that document ID patterns are predictable, making enumeration feasible rather than requiring a full brute-force. Limiting factors: exploitation is constrained to authenticated users only, restricting the attacker population to account holders (clients, insiders, or those with stolen credentials). There is no integrity or availability impact - the vulnerability is purely a confidentiality exposure on trading document PDFs. Non-default configurations or specific deployment modes are not mentioned as prerequisites, suggesting the vulnerable endpoint is present in standard MCO deployments running the affected version.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores 5.3 (Medium), reflecting network accessibility, low complexity, required authentication, and limited confidentiality impact with no integrity or availability consequence. This is not listed in CISA KEV and no POC has been identified, suggesting no confirmed active exploitation. EPSS data was not provided in the source intelligence. Despite the moderate score, real-world risk is elevated by context: MCO is a financial compliance platform, and trading documents likely contain material non-public information, regulatory filings, or client transaction records - making even 'limited' confidentiality compromise potentially significant for regulated entities. The authentication requirement (PR:L) is a meaningful barrier but not a strong one, as any MCO account holder - including potential insiders or compromised accounts - satisfies the precondition. The combination of predictable IDs and low enumeration complexity means a determined authenticated attacker faces few practical obstacles beyond acquiring a valid login.

An attacker with a valid MCO login - such as a client user, insider, or holder of a compromised credential - sends authenticated HTTP requests to the fetchPdfStatement endpoint, iterating over predictable document IDs. Because the application returns the requested PDF without checking that the ID belongs to the requesting user's account, the attacker systematically downloads trading statements from other customers. No public exploit code is known, but the attack requires only standard HTTP tooling and a valid session token.