MCO privilege escalation and IDOR flaws disclosed
MyComplianceOffice MCO software contains multiple critical vulnerabilities including authorization bypass for privilege escalation, IDOR enabling document access, and stored XSS via logo upload.
CERT Polska disclosed eight vulnerabilities in MyComplianceOffice MCO software version 25.3.3.1, with other versions potentially affected. The most severe flaws include CVE-2026-53902, an authorization bypass allowing authenticated users to escalate privileges by modifying their own group membership, and CVE-2026-53903, an IDOR vulnerability enabling unauthorized access to trading documents belonging to other users through predictable document IDs.
Additional vulnerabilities include a stored XSS via SVG logo upload (CVE-2026-53907), path traversal enabling arbitrary file writes (CVE-2026-53906), and an authorization bypass exposing administrator ACL structures to low-privileged users (CVE-2026-53905). The software also suffers from account denial-of-service through password reset abuse (CVE-2026-53904), user enumeration via distinguishable authentication responses (CVE-2026-53908), and client-side-only file upload validation (CVE-2026-53909).
Vendor contact attempts were unsuccessful, and the vulnerabilities were disclosed through CERT Polska's coordinated vulnerability disclosure process. The issues were reported by Hubert Decyusz from AFINE Team. Organizations using MCO should assess their exposure and implement compensating controls pending vendor patches.
Mentioned in this report
Detection guidance
MCO Self-Service Group/Role Membership Modification Attempt
Detects authenticated PUT/POST requests to MCO group or role membership endpoints, consistent with CVE-2026-53902 authorization bypass allowing users to escalate privileges by altering their own group assignment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MCO Self-Service Group/Role Membership Modification Attempt
id: 1c5fa886-6824-5422-bf81-283c0936ca97
status: experimental
description: Detects requests to MCO group/role membership management endpoints using
state-changing HTTP methods, matching the authorization bypass pattern (CVE-2026-53902)
where an authenticated low-privileged user modifies their own group membership to
escalate privileges.
references:
- CERT Polska MCO advisory (CVE-2026-53902)
logsource:
category: webserver
detection:
selection:
cs-method:
- PUT
- POST
- PATCH
cs-uri-stem|contains:
- /group
- /membership
- /role
filter_admin_console:
cs-uri-stem|contains:
- /admin/group
- /admin/role
condition: selection and not filter_admin_console
falsepositives:
- Legitimate administrator-driven group/role management performed through dedicated
admin console paths
- Bulk provisioning scripts updating user group assignments via approved admin API
level: medium
tags:
- attack.T1068
- attack.privilege-escalation
author: Vorant
MCO Sequential Document ID Access Pattern Indicative of IDOR Exploitation
Detects requests to MCO trading document retrieval endpoints using incrementing/predictable numeric document identifiers, consistent with the IDOR flaw (CVE-2026-53903) allowing access to other users' documents. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MCO Sequential Document ID Access Pattern Indicative of IDOR Exploitation
id: ed32ab02-e2ce-5dfe-9d2e-a354efc14da4
status: experimental
description: Detects requests to MCO document endpoints referencing sequential or
enumerated numeric document IDs in the query string or path, matching the IDOR exploitation
pattern in CVE-2026-53903. This rule flags individual matching requests; analysts
should correlate a high volume of distinct document IDs requested by a single session/source
within a short window (e.g. dozens of unique IDs within minutes) as the strongest
indicator of active exploitation.
references:
- CERT Polska MCO advisory (CVE-2026-53903)
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /document
cs-uri-query|re: (?i)(doc(ument)?_?id|docid)=[0-9]+
condition: selection
falsepositives:
- Normal user browsing through their own paginated document list where IDs appear
sequential
- Automated compliance reporting tools iterating over a user's own document set
level: medium
tags:
- attack.T1499.004
- attack.initial-access
author: Vorant
MCO Authentication Enumeration via Distinguishable Login Responses
Detects repeated authentication attempts against MCO login endpoint with varying usernames from a single source, consistent with user enumeration via distinguishable auth responses (CVE-2026-53908). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MCO Authentication Enumeration via Distinguishable Login Responses
id: 52e927ea-b2a5-531e-8d4d-1587fdf63145
status: experimental
description: Detects authentication requests to the MCO login endpoint from a single
source using multiple distinct usernames, which combined with distinguishable success/failure
responses enables user enumeration as described in CVE-2026-53908. This rule matches
individual login attempts; a defensible detection requires correlating many distinct
usernames (e.g. 10+) from the same source IP within a short time window, which should
be enforced as a threshold in the SIEM correlation layer rather than in this rule's
condition.
references:
- CERT Polska MCO advisory (CVE-2026-53908)
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /login
- /auth
cs-method: POST
condition: selection
falsepositives:
- Single sign-on or password manager batch login attempts from shared corporate proxies
- Legitimate helpdesk password reset testing across multiple accounts
level: low
tags:
- attack.T1087
- attack.discovery
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-53902
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free