CVE-2026-57951 is an authorization bypass vulnerability in Mythic before version 3.4.0.60. The issue stems from a broken Hasura permission filter on the payload_build_step table, which includes an always-satisfied _or condition. This condition effectively bypasses operation-scoped access controls, enabling authenticated users with operator or spectator roles to query and read sensitive data fields (step_stdout, step_stderr, step_name, step_description) from all operations on the server, regardless of their intended permissions.

Authenticated operators and spectators can access sensitive information from the payload_build_step table across all operations, potentially exposing internal step outputs and descriptions that should be restricted. This unauthorized data exposure could aid attackers in understanding payload build steps and internal processes, increasing the risk of further exploitation or information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor the vendor's communications for updates and consider restricting access to authenticated operators and spectators until a fix is available.