# MCO privilege escalation and IDOR flaws disclosed

Published: 2026-07-01 · Severity: high · Sectors: financial-services
Canonical: https://vorant.io/reports/7d46d2f0-619d-57f3-b378-2bbbe709f288/mco-privilege-escalation-and-idor-flaws-disclosed

> MyComplianceOffice MCO software contains multiple critical vulnerabilities including authorization bypass for privilege escalation, IDOR enabling document access, and stored XSS via logo upload.

CERT Polska disclosed eight vulnerabilities in MyComplianceOffice MCO software version 25.3.3.1, with other versions potentially affected. The most severe flaws include CVE-2026-53902, an authorization bypass allowing authenticated users to escalate privileges by modifying their own group membership, and CVE-2026-53903, an IDOR vulnerability enabling unauthorized access to trading documents belonging to other users through predictable document IDs.

Additional vulnerabilities include a stored XSS via SVG logo upload (CVE-2026-53907), path traversal enabling arbitrary file writes (CVE-2026-53906), and an authorization bypass exposing administrator ACL structures to low-privileged users (CVE-2026-53905). The software also suffers from account denial-of-service through password reset abuse (CVE-2026-53904), user enumeration via distinguishable authentication responses (CVE-2026-53908), and client-side-only file upload validation (CVE-2026-53909).

Vendor contact attempts were unsuccessful, and the vulnerabilities were disclosed through CERT Polska's coordinated vulnerability disclosure process. The issues were reported by Hubert Decyusz from AFINE Team. Organizations using MCO should assess their exposure and implement compensating controls pending vendor patches.

## Mentioned in this report

- Vulnerabilities: CVE-2026-53902, CVE-2026-53903, CVE-2026-53904, CVE-2026-53905, CVE-2026-53906, CVE-2026-53907, CVE-2026-53908, CVE-2026-53909

## Detection guidance (public sample)

### MCO Self-Service Group/Role Membership Modification Attempt

ATT&CK: T1068

Detects authenticated PUT/POST requests to MCO group or role membership endpoints, consistent with CVE-2026-53902 authorization bypass allowing users to escalate privileges by altering their own group assignment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MCO Self-Service Group/Role Membership Modification Attempt
id: 1c5fa886-6824-5422-bf81-283c0936ca97
status: experimental
description: Detects requests to MCO group/role membership management endpoints using
  state-changing HTTP methods, matching the authorization bypass pattern (CVE-2026-53902)
  where an authenticated low-privileged user modifies their own group membership to
  escalate privileges.
references:
- CERT Polska MCO advisory (CVE-2026-53902)
logsource:
  category: webserver
detection:
  selection:
    cs-method:
    - PUT
    - POST
    - PATCH
    cs-uri-stem|contains:
    - /group
    - /membership
    - /role
  filter_admin_console:
    cs-uri-stem|contains:
    - /admin/group
    - /admin/role
  condition: selection and not filter_admin_console
falsepositives:
- Legitimate administrator-driven group/role management performed through dedicated
  admin console paths
- Bulk provisioning scripts updating user group assignments via approved admin API
level: medium
tags:
- attack.T1068
- attack.privilege-escalation
author: Vorant
```

### MCO Sequential Document ID Access Pattern Indicative of IDOR Exploitation

ATT&CK: T1499.004

Detects requests to MCO trading document retrieval endpoints using incrementing/predictable numeric document identifiers, consistent with the IDOR flaw (CVE-2026-53903) allowing access to other users' documents. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MCO Sequential Document ID Access Pattern Indicative of IDOR Exploitation
id: ed32ab02-e2ce-5dfe-9d2e-a354efc14da4
status: experimental
description: Detects requests to MCO document endpoints referencing sequential or
  enumerated numeric document IDs in the query string or path, matching the IDOR exploitation
  pattern in CVE-2026-53903. This rule flags individual matching requests; analysts
  should correlate a high volume of distinct document IDs requested by a single session/source
  within a short window (e.g. dozens of unique IDs within minutes) as the strongest
  indicator of active exploitation.
references:
- CERT Polska MCO advisory (CVE-2026-53903)
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /document
    cs-uri-query|re: (?i)(doc(ument)?_?id|docid)=[0-9]+
  condition: selection
falsepositives:
- Normal user browsing through their own paginated document list where IDs appear
  sequential
- Automated compliance reporting tools iterating over a user's own document set
level: medium
tags:
- attack.T1499.004
- attack.initial-access
author: Vorant
```

### MCO Authentication Enumeration via Distinguishable Login Responses

ATT&CK: T1087

Detects repeated authentication attempts against MCO login endpoint with varying usernames from a single source, consistent with user enumeration via distinguishable auth responses (CVE-2026-53908). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MCO Authentication Enumeration via Distinguishable Login Responses
id: 52e927ea-b2a5-531e-8d4d-1587fdf63145
status: experimental
description: Detects authentication requests to the MCO login endpoint from a single
  source using multiple distinct usernames, which combined with distinguishable success/failure
  responses enables user enumeration as described in CVE-2026-53908. This rule matches
  individual login attempts; a defensible detection requires correlating many distinct
  usernames (e.g. 10+) from the same source IP within a short time window, which should
  be enforced as a threshold in the SIEM correlation layer rather than in this rule's
  condition.
references:
- CERT Polska MCO advisory (CVE-2026-53908)
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - /login
    - /auth
    cs-method: POST
  condition: selection
falsepositives:
- Single sign-on or password manager batch login attempts from shared corporate proxies
- Legitimate helpdesk password reset testing across multiple accounts
level: low
tags:
- attack.T1087
- attack.discovery
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-53902

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7d46d2f0-619d-57f3-b378-2bbbe709f288/mco-privilege-escalation-and-idor-flaws-disclosed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup