Description
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation.
An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques.



Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Published: 2026-07-01
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MCO fails to enforce proper authorization checks on the /customer/servlet/mco/webapi/profile‑sections/group‑membership endpoint, allowing an authenticated user to modify their own group membership without proper verification. By submitting a valid group identifier—obtained through the group‑picker API or guessed—an attacker can add themselves to any group, thereby gaining elevated privileges. The flaw is rooted in missing authorization controls (CWE-266) and improper access control via identifiers (CWE-863).

Affected Systems

The issue has been confirmed in MyComplianceOffice MCO version 25.3.3.1. Vendor warnings indicate that other releases may also be impacted, but no official confirmation yet exists and no patch has been released due to unsuccessful vendor contact attempts.

Risk and Exploitability

The CVSS score is 7.1, indicating a medium‑high severity exposure. The EPSS score is below 1%, reflecting a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must obtain or guess a valid group ID, which can be sourced via the group‑picker endpoint or through brute‑force enumeration. With an authenticated session, the vulnerability can be exploited to elevate privileges.

Generated by OpenCVE AI on July 21, 2026 at 14:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update MyComplianceOffice MCO to the latest release that includes the authorization fix, or apply any vendor‑supplied patch addressing the group‑membership endpoint.
  • Ensure that only privileged accounts are granted access to the group‑picker and profile‑sections APIs, and enforce strict role‑based access control for group modification actions.
  • Restrict or filter the group‑picker endpoint to prevent enumeration of valid group identifiers, thereby reducing an attacker’s ability to obtain the necessary group IDs for exploitation.

Generated by OpenCVE AI on July 21, 2026 at 14:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Mycomplianceoffice
Mycomplianceoffice mco
Vendors & Products Mycomplianceoffice
Mycomplianceoffice mco

Fri, 03 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Title Privilege Escalation in MCO
Weaknesses CWE-266
CWE-863
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mycomplianceoffice Mco
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-01T13:42:53.914Z

Reserved: 2026-06-11T07:44:52.179Z

Link: CVE-2026-53902

cve-icon Vulnrichment

Updated: 2026-07-01T13:42:50.608Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T15:00:09Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-863

    Incorrect Authorization