CVE-2026-53902

🗓️ 01 Jul 2026 11:58:31Reported by CERT-PLType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Authenticated users can alter their group membership via the profile-sections group-membership endpoint, enabling privilege escalation in version 25.3.3.1.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2026-53906	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53908	1 Jul 202611:59	–	attackerkb
ATTACKERKB	CVE-2026-53905	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53907	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53904	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53909	1 Jul 202611:59	–	attackerkb
ATTACKERKB	CVE-2026-53902	1 Jul 202611:58	–	attackerkb
ATTACKERKB	CVE-2026-53903	1 Jul 202611:58	–	attackerkb
Circl	CVE-2026-53902	1 Jul 202613:15	–	circl
CVE	CVE-2026-53907	1 Jul 202611:58	–	cve

NVD

Node

mycomplianceoffice mycomplianceofficeMatch25.3.3.1

[
  {
    "vendor": "MyComplianceOffice",
    "product": "MCO",
    "versions": [
      {
        "status": "affected",
        "version": "25.3.3.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
mco	www.mco.mycomplianceoffice.com/
cert	www.cert.pl/en/posts/2026/07/CVE-2026-53902

Parameter	Position	Path	Description	CWE
group_id	request body	/customer/servlet/mco/webapi/profile-sections/group-membership	Authorized user can modify their group membership without proper authorization, enabling privilege escalation by supplying a valid group ID.	CWE-863, CWE-266

06 Jul 2026 17:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

CVSS 47.1

EPSS0.00342

SSVC