CVE-2026-53902
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in MCO allows an authenticated user to modify group membership without proper authorization checks, leading to privilege escalation. An attacker can add themselves to arbitrary groups by providing a valid group ID, which can be obtained from other application functionalities or guessed via brute-force.
Risk Assessment
The risk involves unauthorized privilege escalation, potentially allowing an attacker to access sensitive data or system functions, compromising confidentiality and integrity.
Recommendation
It is recommended to apply security patches from the vendor if available, or implement temporary mitigations such as restricting access to the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint and strengthening authorization controls.
Other vulnerabilities in MCO
See all- CVE-2026-53909Medium
The vulnerability in MCO is due to missing server-side validation of uploaded file types. Validation relies solely on client-side checks, which can be bypassed. An authenticated, low-privileged attacker can upload files of arbitrary types to the server.
- CVE-2026-53908Medium
MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations, allowing an attacker to enumerate valid usernames and email addresses.
- CVE-2026-53907Medium
Stored Cross‑Site Scripting (XSS) vulnerability in MCO allows an attacker to upload a malicious SVG file as the application logo. The JavaScript code executes when the logo is rendered or opened.
- CVE-2026-53906High
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages.
- CVE-2026-53905High
A vulnerability in MCO allows an authenticated low-privileged user to retrieve administrator access control structures via the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint due to missing authorization checks. This may expose sensitive permission mappings and internal configuration details.
- CVE-2026-53904High
A vulnerability in MCO allows an attacker to lock a victim's account by repeatedly resetting the password. Each reset request invalidates the previous password and temporary passwords, with no limit on the number of resets. An attacker who knows the victim's email and security question answer can effectively deny access to the account.
- CVE-2026-53903High
An IDOR vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint allows unauthorized access to other users' trading documents. The lack of permission validation enables document retrieval based on a guessable identifier.
Original NVD description (English source)
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrary groups by supplying a valid group ID, which can be obtained via other application functionalities (e.g. /customer/servlet/mco/webapi/group/picker/groups), provided he has necessary permissions, or potentially inferred through brute-force techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.