CVE-2026-53905

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-539068.2MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validatioCVE-2026-539075.4MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to changeCVE-2026-539084.3MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for CVE-2026-539096.5MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can bCVE-2026-53916.4The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_reCVE-2026-539102.1diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculaCVE-2026-539116.3Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain CVE-2026-539125.1Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrCVE-2026-539139.8Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel KCVE-2026-539149.8In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadataCVE-2026-539158.8In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configurationCVE-2026-539167.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticat