CVE-2026-53903 — HIGH (8.1)

Vulnerability Description

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other users by providing a valid document ID. Although exploitation requires guessing the identifier, predictable ID patterns enable feasible enumeration, leading to unauthorized disclosure of sensitive information. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Mycomplianceoffice	Mycomplianceoffice	25.3.3.1

Related Weaknesses (CWE)

CWE-639

References

https://cert.pl/en/posts/2026/07/CVE-2026-53902Third Party Advisory
https://mco.mycomplianceoffice.com/Product

FAQ

What is CVE-2026-53903?

CVE-2026-53903 is a vulnerability with a CVSS score of 8.1 (HIGH). MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validat...

How severe is CVE-2026-53903?

CVE-2026-53903 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-53903?

Check the references section above for vendor advisories and patch information. Affected products include: Mycomplianceoffice Mycomplianceoffice.