MyComplianceOffice vulnerabilities
We track 4 vulnerabilities in MyComplianceOffice products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest MyComplianceOffice vulnerabilities
- 8.2 High severity
MCO: Improper Limitation of a Pathname to a Restricted Directory
MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute serve
- 7.1 High severity
MCO: Incorrect Authorization
MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization
- 7.1 High severity
MCO: Improper Restriction of Excessive Authentication Attempts
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are no
- 8.1 High severity
MCO: Authorization Bypass Through User-Controlled Key
MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a re