CVE-2026-53905: MCO Authorization Bypass Vulnerability

CVE-2026-53905 Overview

CVE-2026-53905 is a broken access control vulnerability in MyComplianceOffice (MCO). The flaw resides in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. The endpoint fails to enforce authorization checks on incoming requests. Any authenticated user with low privileges can invoke the endpoint and retrieve administrator access control list (ACL) tree structures. Exposed data includes sensitive permission mappings and internal configuration details useful for follow-on attacks. The issue is confirmed in version 25.3.3.1. Other versions may also be affected because vendor contact attempts were unsuccessful. The vulnerability is categorized under [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated low-privileged users can enumerate administrator ACL structures, exposing permission mappings that support privilege escalation and reconnaissance.

Affected Products

MyComplianceOffice (MCO) version 25.3.3.1
Earlier and later MCO versions may be affected (not confirmed by vendor)
Deployments exposing the /customer/servlet/mco/webapi/admin-view-hierarchy/ API surface

Discovery Timeline

2026-07-01 - CVE-2026-53905 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database
CERT Poland - Coordinated disclosure documented in the CERT Poland advisory

Technical Details for CVE-2026-53905

Vulnerability Analysis

The vulnerability is a server-side authorization flaw in an administrative web API. The MCO application exposes the get-acl-tree-structure operation through the admin-view-hierarchy servlet path. This operation is designed to return the hierarchical structure of ACLs used to govern administrative access. The endpoint authenticates the caller but does not verify that the caller holds administrator-level privileges. Authorization and authentication are conflated, allowing any valid session to reach administrative data.

An attacker with a standard user account can issue a request to the endpoint and receive the full ACL tree in response. The returned structure discloses role assignments, permission groupings, and internal identifiers that describe how the tenant is configured. Exposure is limited to confidentiality of authorization metadata, with no direct write or availability impact.

Root Cause

The root cause is a missing authorization check on a privileged web API route. The servlet trusts the authenticated session context and returns administrator data without evaluating the caller's role or scope. This is a classic [CWE-863] failure where an access control decision required by the business logic is not performed at the request boundary.

Attack Vector

Exploitation requires network access to the MCO web application and a valid low-privileged account. The attacker sends an HTTP request to /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure using standard session credentials. The server returns the administrator ACL tree in the response body. No user interaction, elevated privileges, or specialized tooling are required.

The vulnerability is described in prose only. No verified proof-of-concept code is published. See the CERT Poland advisory for technical details.

Detection Methods for CVE-2026-53905

Indicators of Compromise

HTTP requests to /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure originating from non-administrator sessions
Repeated access to admin-view-hierarchy API paths from a single low-privileged user identity
Web server responses returning ACL tree payloads to accounts without admin roles

Detection Strategies

Inspect application and reverse-proxy access logs for calls to the admin-view-hierarchy route and correlate the caller's role with the endpoint's expected privilege level
Deploy a web application firewall (WAF) rule that blocks or alerts on admin-view-hierarchy API access from sessions lacking an administrator role claim
Baseline typical API usage per user role and alert on deviations that show standard accounts hitting admin-only routes

Monitoring Recommendations

Forward MCO web logs and authentication events to a centralized SIEM or data lake for correlation and retention
Alert on any HTTP 200 response from the vulnerable endpoint that is not tied to an administrator identity
Track outbound data volume from the endpoint to detect bulk enumeration of ACL structures

How to Mitigate CVE-2026-53905

Immediate Actions Required

Restrict network access to the MCO administrative API paths using firewall rules or reverse-proxy allowlists
Audit user accounts with active sessions and remove unused or over-privileged accounts
Review web server logs for prior access to /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure by non-administrator users

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Vendor contact attempts referenced in the advisory were unsuccessful. Monitor the MyComplianceOffice portal and the CERT Poland advisory for fix availability. Apply vendor-issued updates when they become available and validate that authorization is enforced on all admin-view-hierarchy routes.

Workarounds

Block external access to /customer/servlet/mco/webapi/admin-view-hierarchy/* at the reverse proxy or WAF, allowing only known administrator source addresses
Enforce role-based access control at the proxy layer by inspecting session tokens and rejecting non-admin sessions that request administrative endpoints
Rotate credentials and session tokens for any accounts observed accessing the vulnerable endpoint

bash

# Example NGINX reverse-proxy block for the vulnerable endpoint
location ~* ^/customer/servlet/mco/webapi/admin-view-hierarchy/ {
    allow 10.0.0.0/24;    # admin management subnet
    deny  all;
    proxy_pass http://mco_backend;
}