CVE-2026-57951CWE-863

Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table

High · published June 29, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-29T17:20Z
EPSS history
Timeline
  • 29 JUN 17:20Z
    Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table
    cvelistv5