Executive brief
MyComplianceOffice (MCO) is a compliance management platform used by financial services and insurance firms to manage regulatory obligations. A security flaw in the platform's group membership system allows an authenticated user to change their own group assignments without proper authorization. This could allow a regular employee to grant themselves administrative privileges or access sensitive compliance data belonging to other departments.
Technical details
The vulnerability exists in the '/customer/servlet/mco/webapi/profile-sections/group-membership' endpoint due to a lack of server-side authorization checks (CWE-863, CWE-266). An authenticated attacker can send a request to this endpoint with a valid group ID to modify their own group membership. Group IDs can be discovered through other API endpoints like '/customer/servlet/mco/webapi/group/picker/groups' or via brute-force. Successful exploitation results in vertical privilege escalation. As of the advisory date, the vendor has not responded to contact attempts, and no patch has been confirmed.
Affected products
- MyComplianceOffice MCO 25.3.3.1
Timeline
- 2026-07-01: advisory: Advisory published by CERT Polska
- 2026-07-01: disclosed: Public disclosure of CVE-2026-53902