CVE-2026-57953— Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| its-a-feature | Mythic | < 3.4.0.60 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57953
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Cody Thomas Mythic 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cody Thomas Mythic是Cody Thomas个人开发者的一个黑客工具框架。 Cody Thomas Mythic 3.4.0.60之前版本存在授权问题漏洞，该漏洞源于访问控制配置错误，允许经过身份验证的观察者角色用户通过访问监管者允许的中间件中注册的eventing_import_automatic_webhook端点执行未经授权的写入操作，导致创建和删除自动化工作流，对操作自动化配置和EventGroups进行未经授权的修改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| its-a-feature | Mythic | 0 ~ 3.4.0.60 | - |
II. Public POCs for CVE-2026-57953
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57953
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57953 (1)
Vendor Advisories for CVE-2026-57953 (1)
Proof of Concept for CVE-2026-57953 (1)
Other References for CVE-2026-57953 (1)
- 🔗 Release v3.4.0.60 · its-a-feature/Mythic · GitHubrelease-notes
Same Patch Batch · its-a-feature · 2026-06-29 · 3 CVEs total
| CVE-2026-57951 | 6.5 MEDIUM | Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table |
| CVE-2026-57952 | 5.3 MEDIUM | Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UU |
IV. Related Vulnerabilities
Same weakness: CWE-863
- CVE-2026-48449
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE- - CVE-2026-67439
OliveTin: StartActionAndWait Endpoints Bypass `logs` Permiss - CVE-2026-65975
Pydantic AI AG-UI Adapter: A dangling client-submitted tool - CVE-2025-14562
Incorrect Authorization in GitLab - CVE-2026-6336
Incorrect Authorization in GitLab
V. Comments for CVE-2026-57953
No comments yet