CVE-2026-53902
CVE-2026-53902 is a medium-severity vulnerability in Mycomplianceoffice with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-266.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 7.1
- EPSS exploit prediction: 0% (11th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-266
- Affected product: Mycomplianceoffice
- Published:
- Last modified:
Description
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Frequently asked questions
- What is CVE-2026-53902?
- MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
- How severe is CVE-2026-53902?
- CVE-2026-53902 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2026-53902 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-53902?
- CVE-2026-53902 affects Mycomplianceoffice. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-53902?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-53902 published?
- CVE-2026-53902 was published on 2026-07-01 and last updated on 2026-07-06.
References
Affected products (1)
- cpe:2.3:a:mycomplianceoffice:mycomplianceoffice:25.3.3.1:*:*:*:*:*:*:*
More vulnerabilities in Mycomplianceoffice
- CVE-2026-53906 — High (CVSS 8.2): MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and…
- CVE-2026-53903 — High (CVSS 8.1): MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the…
- CVE-2026-53905 — High (CVSS 7.1): MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree…
- CVE-2026-53909 — Medium (CVSS 6.5): MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on…
- CVE-2026-53907 — Medium (CVSS 5.4): MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker…
- CVE-2026-53908 — Medium (CVSS 4.3): MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns…
All CVEs affecting Mycomplianceoffice →
Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities
- CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
- CVE-2025-41115 — Critical (CVSS 10.0): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage…
- CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
- CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
- CVE-2026-42368 — Critical (CVSS 9.9): A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A…
- CVE-2026-32922 — Critical (CVSS 9.9): OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with…
Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →