CVE-2026-53903: Insecure Direct Object Reference in MCO
MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other users by providing a valid document ID. Although exploitation requires guessing the identifier, predictable ID patterns enable feasible enumeration, leading to unauthorized disclosure of sensitive information.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53903?
CVE-2026-53903 has a medium severity rating of 5.3.
How do I fix CVE-2026-53903?
To mitigate CVE-2026-53903, ensure proper validation of user access permissions for the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint.
What type of vulnerability is CVE-2026-53903?
CVE-2026-53903 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
What impact does CVE-2026-53903 have?
CVE-2026-53903 can potentially allow unauthorized users to access sensitive documents without proper authorization.
In which software is CVE-2026-53903 found?
CVE-2026-53903 is found in the MCO application.