CVE-2026-57953: Mythic Authorization Bypass Allows Spectator Role Privilege Escalation

Technical summary

CVE-2026-57953 is an authorization bypass in Mythic's eventing_import_automatic_webhook endpoint. The endpoint is incorrectly registered under spectator-permitted middleware, allowing authenticated users holding spectator roles to perform write operations (create and delete) on automation workflows and EventGroups despite lacking the necessary privilege level. This violates the intended role-based access control (RBAC) model and stems from misconfigured access control logic (CWE-863: Improper Authorization).

Business impact

An attacker with valid spectator credentials—whether through legitimate issuance, credential compromise, or insider access—could disrupt operational automation without administrative approval. This creates unintended modification of operation workflows, EventGroups, and related configurations, potentially causing operational disruption, loss of data integrity in automation rules, and audit trail complications. The impact is contained by the requirement for prior authentication and the limitation to workflow/EventGroup scope, but it still represents a privilege escalation risk in multi-user environments.

Affected systems

Mythic versions before 3.4.0.60 are affected. The vulnerability specifically impacts deployments where spectator role accounts are in use and have network access to the eventing_import_automatic_webhook endpoint. Any organization relying on Mythic's role-based access control to segregate operator privileges should be considered at risk.

Exploitability

Exploitation requires valid authentication credentials for a spectator-role account, which limits the attack surface to insider threats or scenarios where spectator accounts have been compromised. No network authentication bypass is required; the attacker must already be authenticated to the Mythic platform. The vulnerability is straightforward to exploit once credentials are obtained—no complex exploitation chains or user interaction are necessary. The CVSS score of 5.4 (Medium) reflects the authentication requirement that gates access.

Remediation

Upgrade Mythic to version 3.4.0.60 or later. This patch corrects the endpoint's middleware configuration to enforce proper authorization checks for write operations on automation workflows and EventGroups. Organizations should verify the patch is deployed across all Mythic instances, including any disconnected or air-gapped environments.

Patch guidance

Update Mythic to 3.4.0.60 or a later release. Verify against the its-a-feature Mythic project's official release notes and security advisories to confirm patch availability and deployment instructions. Test the upgrade in a non-production environment first to ensure compatibility with existing automation workflows and configurations. Coordinate the deployment to minimize disruption to active operations.

Detection guidance

Monitor for anomalous write operations to the eventing_import_automatic_webhook endpoint originating from accounts with spectator role assignments. Audit logs should show workflow or EventGroup creation/deletion events and correlate them with user identity and role. Look for patterns inconsistent with normal spectator activity—spectators should rarely or never initiate automation changes. In Mythic deployments with verbose logging, examine endpoint access logs and RBAC evaluation traces for evidence of unauthorized operations succeeding when they should have been denied.

Why prioritize this

Although rated MEDIUM severity (5.4 CVSS), this vulnerability should be prioritized based on organizational risk appetite. The vulnerability requires authentication to exploit, which naturally limits exposure. However, in environments with numerous spectator accounts or lenient credential management, the window for misuse is wider. Insider threat models and supply-chain compromises of spectator credentials elevate practical risk. Patch within 30–60 days for most organizations; expedite to 2–4 weeks if spectator role usage is widespread or if you operate in a high-stakes operational environment.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), low privilege level required (PR:L, spectator role), no user interaction (UI:N), unchanged scope (S:U), and impacts to integrity and availability but not confidentiality (I:L/A:L). The Medium severity is justified by the authentication barrier and the bounded scope of writable resources, but the ease of exploitation and privilege escalation nature warrant close monitoring.

Frequently asked questions