CVE-2026-53903 is an authorization bypass vulnerability (CWE-639) in MyComplianceOffice MCO version 25.3.3.1. The vulnerability exists in the fetchPdfStatement API endpoint, which fails to verify that the authenticated user is authorized to access the requested document. Attackers can exploit this by providing a valid document ID, enabling direct retrieval of other users' trading documents. The vulnerability requires low privileges (authenticated user) and no user interaction, with low complexity due to predictable ID patterns. No official fix or remediation guidance is currently available.

Successful exploitation leads to unauthorized disclosure of sensitive trading documents belonging to other users. This compromises confidentiality of user data within the affected MCO instance. The vulnerability does not require elevated privileges beyond authentication and does not impact system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since vendor contact attempts were unsuccessful and no official fix is available, organizations should consider restricting access to the affected endpoint, monitoring for suspicious access patterns, and applying compensating controls to limit exposure until a patch or official mitigation is provided.