CVE-2026-53905: Unauthorized Access to Administrator ACL View in MCO
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCOto a version that resolves this vulnerability.Fixed in 25.3.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53905?
CVE-2026-53905 has a medium severity rating with a CVSS score of 5.3.
How do I fix CVE-2026-53905?
To fix CVE-2026-53905, you should apply the latest security updates provided by the MCO software vendor.
Who is affected by CVE-2026-53905?
CVE-2026-53905 affects any authenticated users of MCO who have low privileges.
What are the potential risks of CVE-2026-53905?
The risk of CVE-2026-53905 is that low-privileged users can access sensitive administrator access control structures.
When was CVE-2026-53905 published?
CVE-2026-53905 was published on July 1, 2026.