CVE-2026-57953CWE-863

Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint

Medium · published June 29, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00438 · 37.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-06-29T17:21Z
EPSS history
Timeline
  • 29 JUN 17:21Z
    Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
    cvelistv5