CVE-2026-57646: Majestic Support IDOR Vulnerability – Subscriber Data Access Risk

Technical summary

The vulnerability stems from insufficient access controls on subscriber resources in Majestic Support. The application fails to enforce proper authorization checks when handling requests to subscriber objects, allowing an authenticated attacker with valid credentials to reference arbitrary subscriber IDs and retrieve or modify associated data. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network-accessible exploitation requiring valid authentication, with low attack complexity, limited confidentiality and integrity impact, and no availability impact. The attack vector indicates this is exploitable remotely over the network without special network conditions.

Business impact

An authenticated attacker exploiting this IDOR could view sensitive subscriber information such as account details, payment history, contact information, or support tickets belonging to other customers. Depending on the scope of subscriber data exposed and applicable privacy regulations (GDPR, CCPA, etc.), this could result in regulatory fines, loss of customer trust, and reputational harm. The ability to modify subscriber data could also enable fraudulent actions or service disruption for affected customers.

Affected systems

Majestic Support versions 1.1.7 and earlier are vulnerable. Organizations running this software should inventory all instances and determine the current deployed version. The vulnerability affects any deployment where users have subscriber-level access and the application processes subscriber-related API calls or web requests.

Exploitability

Exploitation requires valid authentication credentials to the Majestic Support application. An attacker with a legitimate user account can systematically enumerate subscriber IDs and access resources belonging to other subscribers. The attack is straightforward to execute once authenticated—no special tools or complex techniques are required, only HTTP requests with manipulated object identifiers. The lack of a public exploit and KEV listing status does not imply unexploitability; IDOR vulnerabilities are routinely discovered and exploited during normal security testing.

Remediation

Upgrade Majestic Support to a patched version released after 1.1.7. Organizations unable to patch immediately should implement compensating controls such as API gateway rules that validate subscriber ownership before processing requests, or restrict subscriber account access to administrators only until a patch is available. Review access logs for any evidence of unauthorized subscriber data access.

Patch guidance

Check the Majestic Support vendor advisory and release notes for versions newer than 1.1.7 that address this IDOR vulnerability. Apply the latest available patch after testing in a non-production environment. Verify the patch resolves the authorization checks on subscriber object access. If your current version is already above 1.1.7, confirm it includes the security fixes from subsequent releases.

Detection guidance

Monitor HTTP request logs for patterns indicating IDOR exploitation: authenticated users accessing subscriber resources with IDs they do not own, sequential or unusual subscriber ID enumeration, or repeated access attempts to the same subscriber IDs from different user accounts. Implement request logging that captures user identity, requested subscriber ID, and authorization decision outcomes. Look for error patterns or exceptions in application logs when unauthorized subscriber access is attempted.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prompt attention because: (1) exploitation requires only valid credentials, which are common in multi-user support environments; (2) subscriber data typically includes sensitive personal and financial information; (3) the fix is a straightforward patch from the vendor; (4) IDOR vulnerabilities are frequently exploited in the wild; and (5) regulatory exposure is significant if customer data is compromised. Organizations with strict data protection requirements should treat this as HIGH priority.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a networked vulnerability requiring authentication (PR:L), with low attack complexity and no user interaction needed. Confidentiality and integrity are partially compromised (C:L/I:L), but availability is not affected (A:N). The scope is unchanged, meaning the impact is limited to the vulnerable component. While not CRITICAL, the combination of easy exploitation post-authentication and access to sensitive data warrants rapid remediation, particularly in customer-facing support platforms.

Frequently asked questions