CVE-2026-57953 is an authorization bypass vulnerability in Mythic before version 3.4.0.60. Authenticated users assigned the spectator role can exploit a misconfigured access control on the eventing_import_automatic_webhook endpoint, which is mistakenly accessible under spectator-permitted middleware. This allows these users to perform unauthorized write operations, including creating and deleting automation workflows and altering operation automation configurations and EventGroups. The vulnerability arises from improper enforcement of authorization controls on a sensitive endpoint.

Exploitation of this vulnerability allows users with limited spectator privileges to escalate their capabilities to perform unauthorized write actions. This can lead to unauthorized creation and deletion of automation workflows and modifications to operation automation configurations and EventGroups, potentially disrupting normal operations or enabling further malicious activity within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict spectator role assignments to trusted users only and consider additional access controls or monitoring around the eventing_import_automatic_webhook endpoint to detect or prevent unauthorized modifications.