CVE-2026-53902

🗓️ 01 Jul 2026 11:58:31Reported by CERT-PLType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

Authenticated users can alter their group membership via the profile-sections group-membership endpoint, enabling privilege escalation in version 25.3.3.1.

Reporter	Title	Published	Views	Family All 22
ATTACKERKB	CVE-2026-53906	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53908	1 Jul 202611:59	–	attackerkb
ATTACKERKB	CVE-2026-53905	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53907	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53904	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53909	1 Jul 202611:59	–	attackerkb
ATTACKERKB	CVE-2026-53902	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53903	1 Jul 202611:58	–	attackerkb
Circl	CVE-2026-53902	1 Jul 202613:15	–	circl
Cvelist	CVE-2026-53902 Privilege Escalation in MCO	1 Jul 202611:58	–	cvelist

NVD

Vulners

Node

mycomplianceoffice mycomplianceofficeMatch25.3.3.1

[
  {
    "vendor": "MyComplianceOffice",
    "product": "MCO",
    "versions": [
      {
        "status": "affected",
        "version": "25.3.3.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
mco	www.mco.mycomplianceoffice.com/
cert	www.cert.pl/en/posts/2026/07/CVE-2026-53902

Parameter	Position	Path	Description	CWE
group_id	request body	customer/servlet/mco/webapi/profile-sections/group-membership	Unauthorized modification of group membership via group-membership endpoint by supplying a valid group ID, enabling privilege escalation.	CWE-266, CWE-863

06 Jul 2026 17:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

CVSS 47.1

EPSS0.00208

SSVC