# CVE-2026-53902: MyComplianceOffice MCO privilege escalation in group-membership endpoint

Source: https://junglewise.ai/threats/cve-2026-53902-mycomplianceoffice-mco-privilege-escalation-in-group-membership  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-53902 · Severity: info · CVSS 7.1 · Published 2026-07-01

MyComplianceOffice (MCO) is a compliance management platform used by financial services and insurance firms to manage regulatory obligations. A security flaw in the platform's group membership system allows an authenticated user to change their own group assignments without proper authorization. This could allow a regular employee to grant themselves administrative privileges or access sensitive compliance data belonging to other departments.

Technologies: [MyComplianceOffice MCO](https://junglewise.ai/threats/technologies/mco). Vendors: [MyComplianceOffice](https://junglewise.ai/threats/vendors/mycomplianceoffice).

## Quick answers

**Is CVE-2026-53902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53902 being exploited in the wild.

**How severe is CVE-2026-53902?** Informational severity, with a CVSS score of 7.1, published 1 July 2026.

**Which products and versions are affected?** MyComplianceOffice MCO 25.3.3.1.

**Is there a fix for CVE-2026-53902?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53902 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53902?** Check whether you run MyComplianceOffice MCO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the '/customer/servlet/mco/webapi/profile-sections/group-membership' endpoint due to a lack of server-side authorization checks (CWE-863, CWE-266). An authenticated attacker can send a request to this endpoint with a valid group ID to modify their own group membership. Group IDs can be discovered through other API endpoints like '/customer/servlet/mco/webapi/group/picker/groups' or via brute-force. Successful exploitation results in vertical privilege escalation. As of the advisory date, the vendor has not responded to contact attempts, and no patch has been confirmed.

## Affected products

- MyComplianceOffice MCO 25.3.3.1

## Timeline

- 2026-07-01: advisory: Advisory published by CERT Polska
- 2026-07-01: disclosed: Public disclosure of CVE-2026-53902

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-53902](https://cert.pl/en/posts/2026/07/CVE-2026-53902)
- [https://mco.mycomplianceoffice.com/](https://mco.mycomplianceoffice.com/)

## Related threats

- [MyComplianceOffice MCO Unrestricted File Upload](https://junglewise.ai/threats/cve-2026-53909-mycomplianceoffice-mco-unrestricted-file-upload)
- [MyComplianceOffice MCO user enumeration in authentication components](https://junglewise.ai/threats/cve-2026-53908-mycomplianceoffice-mco-user-enumeration-in-authentication)
- [MyComplianceOffice MCO Stored XSS in logo upload](https://junglewise.ai/threats/cve-2026-53907-mycomplianceoffice-mco-stored-xss-in-logo-upload)
- [MyComplianceOffice MCO path traversal and path disclosure in file handling](https://junglewise.ai/threats/cve-2026-53906-mycomplianceoffice-mco-path-traversal-and-path-disclosure-in-file)
- [MyComplianceOffice MCO Incorrect Authorization in ACL Tree Endpoint](https://junglewise.ai/threats/cve-2026-53905-mycomplianceoffice-mco-incorrect-authorization-in-acl-tree)