# CVE-2026-53905: MyComplianceOffice MCO Incorrect Authorization in ACL Tree Endpoint

Source: https://junglewise.ai/threats/cve-2026-53905-mycomplianceoffice-mco-incorrect-authorization-in-acl-tree  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-53905 · Severity: info · CVSS 5.3 · Published 2026-07-01

MyComplianceOffice (MCO) is a compliance management platform used by financial services and other regulated industries to manage risk and regulatory obligations. A security flaw in the software allows a standard user to bypass security checks and view sensitive administrative access control structures. This could allow an unauthorized person to see internal permission mappings and configuration details, potentially aiding in further attacks on the system.

Technologies: [MyComplianceOffice MCO](https://junglewise.ai/threats/technologies/mco). Vendors: [MyComplianceOffice](https://junglewise.ai/threats/vendors/mycomplianceoffice).

## Quick answers

**Is CVE-2026-53905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53905 being exploited in the wild.

**How severe is CVE-2026-53905?** Informational severity, with a CVSS score of 5.3, published 1 July 2026.

**Which products and versions are affected?** MyComplianceOffice MCO 25.3.3.1.

**Is there a fix for CVE-2026-53905?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53905 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53905?** Check whether you run MyComplianceOffice MCO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the MyComplianceOffice (MCO) software within the '/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure' endpoint. The application fails to validate if the requesting user has administrative privileges before returning the ACL tree structure. An authenticated, low-privileged attacker can send a direct request to this endpoint to retrieve sensitive permission mappings and internal configuration details. The vulnerability has been confirmed in version 25.3.3.1; however, because vendor contact attempts were unsuccessful, it is unknown if a patch is available or if other versions are affected.

## Affected products

- MyComplianceOffice MCO 25.3.3.1

## Timeline

- 2026-07-01: disclosed: Vulnerability disclosed by CERT Polska
- 2026-07-01: advisory: CVE-2026-53905 published

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-53902](https://cert.pl/en/posts/2026/07/CVE-2026-53902)
- [https://mco.mycomplianceoffice.com/](https://mco.mycomplianceoffice.com/)

## Related threats

- [MyComplianceOffice MCO Unrestricted File Upload](https://junglewise.ai/threats/cve-2026-53909-mycomplianceoffice-mco-unrestricted-file-upload)
- [MyComplianceOffice MCO user enumeration in authentication components](https://junglewise.ai/threats/cve-2026-53908-mycomplianceoffice-mco-user-enumeration-in-authentication)
- [MyComplianceOffice MCO Stored XSS in logo upload](https://junglewise.ai/threats/cve-2026-53907-mycomplianceoffice-mco-stored-xss-in-logo-upload)
- [MyComplianceOffice MCO path traversal and path disclosure in file handling](https://junglewise.ai/threats/cve-2026-53906-mycomplianceoffice-mco-path-traversal-and-path-disclosure-in-file)
- [MyComplianceOffice MCO Account Denial of Service in password reset](https://junglewise.ai/threats/cve-2026-53904-mycomplianceoffice-mco-account-denial-of-service-in-password)