Vulnerability · Published Jul 1, 2026 · Assigned by CERT-PL

CVE-2026-53905Unauthorized Access to Administrator ACL View in MCO

Medium 5.3

In plain English

A medium-severity incorrect authorization in MCO from MyComplianceOffice. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 75.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Affected products (as reported)

Vendor	Product	Versions
MyComplianceOffice	MCO	25.3.3.1

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/07/CVE-2026-53902 third-party-advisory
https://mco.mycomplianceoffice.com/ product