Approved changes feed: RSS · Atom
cpe:2.3:a:its-a-feature:mythic:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Its A Feature (fbe0eeb3-523d-525b-9f77-576532c53637) |
|---|---|
| Product | Mythic (8ea0cc37-cb0f-5330-894f-ffa65a890642) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/its-a-feature/mythic |
purl2cpe | 2026-07-28 16:40:48.391693 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57953 |
vulnerable | 2026-07-29 01:03:16.461663 |
Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint
MEDIUM (5.4)
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
Published: 2026-06-29T17:21:31.254Z
Updated: 2026-11-08T14:06:40.393Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57952 |
vulnerable | 2026-07-29 01:03:16.461339 |
Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID
MEDIUM (5.3)
Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters.
Published: 2026-06-29T17:21:03.323Z
Updated: 2026-11-08T14:06:39.714Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57951 |
vulnerable | 2026-07-29 01:03:16.460915 |
Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table
MEDIUM (6.5)
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.
Published: 2026-06-29T17:20:36.203Z
Updated: 2026-11-08T14:06:38.247Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.