Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-57953Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint

Medium 5.4

In plain English

A medium-severity incorrect authorization in Mythic from its-a-feature. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.

Affected products (as reported)

Vendor	Product	Versions
its-a-feature	Mythic	0 – before 3.4.0.60

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

Release Notes release-notes
Researcher Disclosure issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/mythic-unauthorized-automation-workflow-modification-via-eventing-import-automatic-webhook-endpoint third-party-advisory