PT-2026-53669 · Its A Feature · Mythic

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57951

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload build step table with an always-satisfied or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload build step to read step stdout, step stderr, step name, and step description across all operations on the server.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-57951

Affected Products

Mythic

References · 5

• https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57951 · Security Note
• https://github.com/its-a-feature/Mythic/issues/563 · Note
• https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60 · Note
• https://vulncheck.com/advisories/mythic-broken-permission-filter-in-payload-build-step-table · Note