CVE-2026-53905 is an incorrect authorization vulnerability (CWE-863) in MyComplianceOffice MCO version 25.3.3.1. The affected endpoint does not properly enforce authorization checks, allowing authenticated users with low privileges to retrieve administrator access control structures. This exposure can reveal sensitive internal permission mappings and configuration details. Attempts to contact the vendor for remediation information were unsuccessful, and no official fix or patch is currently documented.

An attacker with low-level authenticated access can retrieve sensitive administrator access control structures, which may disclose internal permission mappings and configuration details. This could aid further attacks or privilege escalation attempts. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available and vendor contact attempts were unsuccessful, organizations should consider restricting access to the affected endpoint and monitor for unusual access patterns from low-privileged users. Avoid granting unnecessary authenticated access until a fix is released.