Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: its-a-feature Component: Mythic Clear all filters
TI-2026-41719 CVE-2026-57953 · GHSA-2mvr-4jqv-324m

Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint

Priority LOW 24

Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint re…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00438 Published 2026-06-29 Fixed in 3.4.0.60 CWE-863
TI-2026-41718 CVE-2026-57952 · GHSA-vq63-9qrm-qv35

Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID

Priority LOW 27

Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook)…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00289 Published 2026-06-29 Fixed in 3.4.0.60 CWE-862
TI-2026-41717 CVE-2026-57951 · GHSA-9f32-pf5h-p947

Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table

Priority MEDIUM 64

Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00434 Published 2026-06-29 Fixed in 3.4.0.60 CWE-863