CVE-2026-53908

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Observable Response Discrepancy pada mycomplianceoffice. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and email addresses. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.pl/en/posts/2026/07/CVE-2026-53902 advisory pihak ketiga
• https://mco.mycomplianceoffice.com/ product