CVE-2026-53905: MCO Authorization Bypass Exposes Admin ACL Structures

Technical summary

CVE-2026-53905 is an authorization bypass vulnerability in MyComplianceOffice affecting the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. The endpoint fails to enforce proper access control checks, allowing authenticated users with low privilege levels to retrieve ACL (Access Control List) tree structures intended for administrative access only. This is classified as CWE-863 (Improper Authorization). The vulnerability requires network access and valid authentication credentials but no user interaction, resulting in a CVSS 3.1 score of 7.1 (HIGH severity). The confidentiality impact is low but integrity impact is rated high, indicating that while direct data modification may not occur, the exposed information could enable subsequent attacks.

Business impact

Exposure of administrative access control mappings represents a significant reconnaissance risk. Attackers with basic user credentials gain visibility into the organization's permission hierarchy, administrative role assignments, and internal security structure. This intelligence can inform targeted privilege escalation attempts, social engineering campaigns, or identification of high-value administrative accounts. Organizations relying on MCO for compliance and access management face degraded confidentiality of their security posture, which is particularly concerning given the platform's role in compliance operations.

Affected systems

MyComplianceOffice version 25.3.3.1 is confirmed affected. The vendor was contacted but did not respond, so it is unknown whether earlier versions, later versions, or the current stable release contain this vulnerability. Organizations running any version of MCO should assume potential exposure until the vendor provides definitive version information or patches are released.

Exploitability

Exploitation requires valid authentication credentials and network access to the MCO instance—a low barrier for internal threats or compromised user accounts. No complex exploitation techniques, social engineering, or user interaction is necessary. An attacker can make direct HTTP requests to the vulnerable endpoint and receive administrator ACL data in response. The simplicity of exploitation combined with the broad authentication requirement (any authenticated user) makes this vulnerability relatively straightforward to exploit within an organization.

Remediation

Contact MyComplianceOffice for patched versions and security guidance. In the interim, organizations should: (1) restrict network access to MCO administrative endpoints using firewall rules or WAF policies, (2) implement robust monitoring of access attempts to the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint, (3) audit access logs for unauthorized retrieval of ACL data, and (4) review user access logs to identify whether the vulnerability has been exploited. Apply patches as soon as the vendor provides them.

Patch guidance

Monitor MyComplianceOffice security advisories and vendor communications for patched versions. Verify patch applicability against your deployed version. Test patches in a non-production environment before deployment. The vendor's lack of response to initial contact attempts suggests communication challenges—check multiple channels (support portal, security email, GitHub, community forums) for patch availability. Document patching timelines with your compliance and risk teams given the platform's use in regulated environments.

Detection guidance

Monitor HTTP logs and WAF/proxy access logs for requests to /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure, particularly from non-administrative user accounts. Look for unusual patterns such as repeated requests, access from unexpected IP ranges, or after-hours access. Enable verbose logging on MCO authentication and API endpoints. Check for successful HTTP 200 responses returning ACL tree data to low-privileged users. Review MCO's native audit logs (if available) for authorization bypass attempts or unexpected permission queries.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS severity, low exploitation complexity, and direct exposure of sensitive authorization data. Organizations should prioritize patching or compensating controls immediately following vendor communication. The lack of immediate patch availability does not reduce urgency—instead, it elevates the importance of access controls and monitoring. For compliance-focused organizations, exposure of access control structures may trigger incident reporting obligations depending on regulatory requirements.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a vulnerability accessible over the network (AV:N) with low attack complexity (AC:L) requiring only low-privilege authentication (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U), and while confidentiality impact is low, integrity impact is rated high due to the potential for leveraging exposed ACL information to modify system state or facilitate further attacks. The absence of availability impact prevents a critical rating, but the combination of low-friction exploitation and high-value information exposure justifies the HIGH severity classification.

Frequently asked questions