Multiple flaws found in MyComplianceOffice MCO
CERT Polska coordinated disclosure of eight vulnerabilities in MyComplianceOffice MCO, including privilege escalation, IDOR, and stored XSS bugs.
CERT Polska, working with researcher Hubert Decyusz of the AFINE Team, coordinated disclosure of eight vulnerabilities affecting MyComplianceOffice (MCO), a compliance management platform. The issues span authorization bypasses that let low-privileged users escalate group membership or view administrative ACL structures, an IDOR flaw allowing retrieval of other users' trading documents, a stored XSS via malicious SVG logo uploads, path traversal/disclosure in file export and upload functionality, weak file-type validation relying only on client-side checks, an account denial-of-service through unrestricted password reset abuse, and a user-enumeration weakness in authentication flows.
The vendor did not respond to disclosure attempts, so the vulnerabilities have only been confirmed against MCO version 25.3.3.1, though other versions may be affected. No patches or vendor advisories are referenced, and there is no indication of active exploitation in the wild — this is a coordinated vulnerability disclosure rather than a report of ongoing attacks. Organizations running MCO, which is commonly used for compliance and trading-document management in regulated industries, should assess exposure of the affected endpoints and restrict access pending vendor remediation.
Mentioned in this report
Detection guidance
Unauthorized Account Enumeration via MyComplianceOffice Auth Endpoint
Detects repeated authentication or account-lookup requests to MCO endpoints with varying usernames, indicating user-enumeration abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthorized Account Enumeration via MyComplianceOffice Auth Endpoint
description: Detects high-volume or rapid authentication/account-lookup requests to
MCO endpoints (e.g., /login, /api/user, /reset) with varying username parameters,
exploiting user-enumeration weakness in authentication flow.
tags:
- attack.discovery
- attack.t1087
logsource:
category: proxy
product: generic
detection:
selection:
uri_path|contains:
- /login
- /auth
- /api/user
- /reset
uri_query|contains: user=
filter_legitimate:
http_response_code: 200
source_ip|cidr: 10.0.0.0/8
condition: selection and not filter_legitimate
falsepositives:
- Password-reset flows from legitimate users or support staff
- Automated internal user provisioning or sync tools
level: medium
id: 30bb95a7-91b3-5f24-80fd-4e47be6c2b5a
status: experimental
author: Vorant
Unauthorized Cross-User Document Access via IDOR in MyComplianceOffice
Detects requests to MCO document/trading-file endpoints with manipulated user or resource IDs, exploiting IDOR to access documents not owned by the authenticated user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthorized Cross-User Document Access via IDOR in MyComplianceOffice
description: Detects HTTP requests to MCO document or trading-file export/retrieve
endpoints (e.g., /api/documents, /export, /trading) where the URI path or query
parameter contains a user ID or resource ID that does not match the authenticated
session owner. Generalises on IDOR exploitation pattern (mismatched ID parameter),
not specific document names or IDs.
tags:
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
uri_path|contains:
- /api/documents
- /api/trading
- /export
- /retrieve
uri_query|contains:
- userId=
- user_id=
- resourceId=
- documentId=
filter_own_resource:
uri_query|contains: userId=self
condition: selection and not filter_own_resource
falsepositives:
- Administrative or auditing functions legitimately accessing other users' documents
- Delegated access workflows where one user can intentionally retrieve another user's
files
level: high
id: eb7532a5-e801-5129-a2a4-408d88caf1a6
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-53902
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free