MyComplianceOffice MCO EUVD-2026-40951

Exploitation requires a valid authenticated session with at minimum low-privileged access to the MCO platform (PR:L per CVSS 4.0 vector). The vulnerable endpoint is directly accessible over the network with no additional non-default configuration required (AV:N, AC:L, AT:N). Unauthenticated exploitation is not possible - an attacker must possess or compromise a valid MCO user account. No specific feature flag, deployment mode, or platform configuration is required beyond a working MCO instance with user accounts enabled. The impact is bounded to read-only disclosure of ACL tree structure data; no write, deletion, or availability impact has been demonstrated. The requirement for an existing account limits opportunistic external exploitation but does not protect against insider threats or accounts compromised via other means.

The CVSS 4.0 score of 5.3 (Medium) is well-supported by the available signals: AV:N (network reachable), AC:L (no special conditions), PR:L (requires a valid low-privilege account), and VC:L (low confidentiality impact limited to ACL structure data). There is no integrity or availability component. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. The practical risk is elevated beyond the raw score in regulated-industry deployments where MCO is used: ACL tree data exposes role structures and permission mappings that an insider threat or compromised low-privilege account could use to identify high-value administrator targets or map escalation paths. The primary limiting factor is the authentication prerequisite - unauthenticated exploitation is not possible. The wildcard CPE and unsuccessful vendor contact introduce version-scope uncertainty that complicates fleet-wide impact assessment.

An authenticated MCO user with a standard low-privileged account issues a direct HTTP request to /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure using their session credentials. The server returns the full administrator ACL tree without validating the caller's authorization level, exposing role hierarchies and permission mappings. The attacker uses this data to identify administrator accounts and privilege boundaries, potentially informing a subsequent privilege escalation or targeted phishing attempt against an administrator. No public exploit code has been identified at time of analysis.