CVE-2026-57952 describes an authorization bypass vulnerability in Mythic before version 3.4.0.60. Four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) fail to verify that the requesting operator owns the payload UUID they provide. This flaw allows an operator to access another operation's C2 profile configuration, exposing encryption keys and callback parameters. The vulnerability requires low privileges (operator level) but has a high attack complexity and no user interaction is needed. The vulnerability is not known to be exploited in the wild and no official fix or patch has been documented.

An operator with access to the affected Mythic instance can bypass authorization controls on specific REST endpoints to retrieve sensitive configuration data from other operations. This includes encryption keys and callback parameters used in C2 profiles, potentially compromising operational security and confidentiality. The vulnerability does not allow privilege escalation or remote code execution but exposes sensitive operational data across operation boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict operator access to trusted personnel only and monitor usage of the affected REST endpoints for anomalous access patterns involving payload UUIDs from other operations.