PT-2026-54831 · Mco · Mco

Hubert Decyusz · Published 2026-07-01 · Updated 2026-07-06 · CVE-2026-53905

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions MCO version 25.3.3.1

Description Insufficient authorization enforcement occurs in the '/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure' endpoint. This allows an authenticated user with low privileges to retrieve administrator access control structures, potentially exposing internal configuration details and sensitive permission mappings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-53905

Affected Products

Mco

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-53905 · Security Note
• https://twitter.com/CVEnew/status/2072324848936792095 · Twitter Post
• https://cert.pl/en/posts/2026/07/CVE-2026-53902 · Note
• https://mco.mycomplianceoffice.com · Note
• https://t.me/cveNotify/183673 · Telegram Post
• https://t.me/cveNotify/188721 · Telegram Post
• https://twitter.com/infoflowcloud/status/2072325831834075228 · Twitter Post