MyComplianceOffice MCO EUVD-2026-40953

The attacker must hold an MCO account with privileges sufficient to change the application logo, corresponding to PR:H in the CVSS 4.0 vector - this is the explicit and concrete prerequisite stated in the CVE description. A victim user must passively view a page rendering the uploaded logo (UI:P), but no active victim interaction such as clicking a link is required beyond normal application use. The vulnerability is confirmed only in version 25.3.3.1; whether earlier or later versions are affected is unknown due to absent vendor cooperation. Exploitation is further limited by: (1) the high-privilege access requirement for the logo upload function constraining the realistic attacker population, (2) the bounded client-side impact (no server-side confidentiality or availability exposure per CVSS VC:N/VA:N), and (3) the cloud-hosted nature of the application meaning exploitation does not require network access to internal infrastructure beyond authenticated application access.

The CVSS 4.0 score of 4.8 (Medium) accurately captures several significant risk-limiting factors: PR:H (high privilege is required to access the logo upload function), UI:P (a victim must passively encounter the rendered logo), and bounded impact metrics (VI:L, SC:L, SI:L - no server-side confidentiality exposure). No EPSS score was provided in the available intelligence, and this CVE is not listed in the CISA KEV catalog. No public exploit code has been identified. The realistic attacker population is narrow: the adversary must first hold an MCO account with administrative or logo-management rights, which substantially reduces the probability of exploitation compared to an unauthenticated network flaw. However, in a compliance platform environment - typically populated by legal, audit, and HR personnel - successful session hijacking of a high-privilege account via stored XSS could expose sensitive regulatory and ethics investigation data. The absence of any vendor response introduces material uncertainty: it is unknown whether other versions are affected or whether an internal patch exists but was not communicated to CERT-PL.

An attacker holding an MCO account with logo-management privileges crafts an SVG file embedding a JavaScript payload - for example, a script that exfiltrates the document cookie to an attacker-controlled endpoint - and uploads it as the application logo via the standard UI. Subsequently, any MCO user (including higher-privileged administrators) who loads a page rendering that logo triggers script execution in their own browser context, allowing the attacker to capture session tokens and perform authenticated actions on the victim's behalf. No public exploit code has been identified, but this attack requires no specialized tooling beyond a text editor and browser.