CVE-2026-53902: CWE-266 Incorrect Privilege Assignment in MyComplianceOffice MCO
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
AI Analysis
Technical Summary
CVE-2026-53902 is an incorrect privilege assignment vulnerability (CWE-266) in MyComplianceOffice MCO. The affected endpoint does not enforce proper authorization checks when modifying group memberships, allowing authenticated users to escalate privileges by adding themselves to arbitrary groups. Group IDs can be obtained through other application functionalities or inferred by brute force. The vulnerability was confirmed in version 25.3.3.1. Vendor contact attempts were unsuccessful, and no patch or official remediation has been disclosed.
Potential Impact
An authenticated user can escalate privileges by adding themselves to arbitrary groups without proper authorization. This could lead to unauthorized access to resources or functions restricted to certain groups, potentially compromising the integrity of the system's access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for unauthorized group membership changes. Avoid granting unnecessary permissions that would allow users to exploit this vulnerability.
CVE-2026-53902: CWE-266 Incorrect Privilege Assignment in MyComplianceOffice MCO
Description
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
CVSS v4.0
Score 7.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53902 is an incorrect privilege assignment vulnerability (CWE-266) in MyComplianceOffice MCO. The affected endpoint does not enforce proper authorization checks when modifying group memberships, allowing authenticated users to escalate privileges by adding themselves to arbitrary groups. Group IDs can be obtained through other application functionalities or inferred by brute force. The vulnerability was confirmed in version 25.3.3.1. Vendor contact attempts were unsuccessful, and no patch or official remediation has been disclosed.
Potential Impact
An authenticated user can escalate privileges by adding themselves to arbitrary groups without proper authorization. This could lead to unauthorized access to resources or functions restricted to certain groups, potentially compromising the integrity of the system's access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for unauthorized group membership changes. Avoid granting unnecessary permissions that would allow users to exploit this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-06-11T07:44:52.179Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a450d6927e9c797197b9583
Added to database: 07/01/2026, 12:51:53 UTC
Last enriched: 07/01/2026, 13:06:39 UTC
Last updated: 07/01/2026, 21:33:43 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.