CVE-2026-57953
Medium
Description
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
SeverityMedium
CVSS5.4
Exploit probability—
ProductIts-a-feature Mythic
PublishedJun 29, 2026
First seenJun 29, 2026
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- its-a-feature mythic3.4.0.60 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| its-a-feature mythic | v < 3.4.0.60 | 3.4.0.60 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.