CVE-2026-53902Disclosure(mycomplianceoffice / mycomplianceoffice)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

mycomplianceoffice CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://cert.pl/en/posts/2026/07/CVE-2026-53902

Other references

https://mco.mycomplianceoffice.com/

Weakness type (CWE)

CWE-266CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mycomplianceoffice

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-07-01); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

mycomplianceoffice

Products

mycomplianceoffice

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-01	2	Disclosure2
2026-07-02	1	Disclosure1

Full discourse3 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs91d
Disclosure
CVE-2026-53902 MyComplianceOffice MCO Privilege escalation could let authenticated users modify group membership and access unauthorised compliance data Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-07-01/TIER_2_CVE-2026-53902.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The tweet announces CVE-2026-53902 for MyComplianceOffice, describing a privilege‑escalation flaw and linking to a full analysis report, with no mention of exploits, patches, or active exploitation.
0001046
56 followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-53902 MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify th… https://www.cve.org/CVERecord?id=CVE-2026-53902 ----- Traducción: CVE-2026-53902 MCO… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑53902, detailing an authorization flaw in a specific web API endpoint that permits authenticated users to modify group memberships. No PoC, exploit code, patch, or evidence of active exploitation is provided.
0000033
90 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-53902 MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify th… https://www.cve.org/CVERecord?id=CVE-2026-53902
Post summary
CVE-2026-53902 describes an authorization-check flaw at a specific API endpoint that allows authenticated users to modify group memberships; no PoC, exploit tool, patch information, or reports of active exploitation are disclosed.
00000656
57.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mycomplianceoffice	mycomplianceoffice	25.3.3.1	-	-

Explore more

Back to dashboard mycomplianceoffice CVEs mycomplianceoffice vulnerabilities

What researchers are saying

CVE-2026-53902

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsDisclosure

The tweet announces CVE-2026-53902 for MyComplianceOffice, describing a privilege‑escalation flaw and linking to a full analysis report, with no mention of exploits, patches, or active exploitation.

Infoflowcloud@infoflowcloudDisclosure

The text announces CVE‑2026‑53902, detailing an authorization flaw in a specific web API endpoint that permits authenticated users to modify group memberships. No PoC, exploit code, patch, or evidence of active exploitation is provided.

CVE@CVEnewDisclosure

CVE-2026-53902 describes an authorization-check flaw at a specific API endpoint that allows authenticated users to modify group memberships; no PoC, exploit tool, patch information, or reports of active exploitation are disclosed.