CVE-2026-82267: Missing Authorization in moghtech komodo

CVE-2026-82267 describes a missing authorization vulnerability in moghtech's Komodo product through version 2.3.2. The flaw allows authenticated users to infer internal resource identifiers and trigger audit log entries prior to permission verification in the /execute and /execute/{variant} endpoints. This enables attackers to insert misleading audit records that falsely indicate privileged actions were performed.

The vulnerability allows authenticated users with limited privileges to obtain internal resource identifiers and insert fraudulent audit entries that misrepresent privileged operations. This undermines the integrity of audit logs, potentially complicating forensic investigations and trust in system monitoring. There is no indication of direct unauthorized access or privilege escalation beyond audit log manipulation.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to the affected endpoints if possible and monitor for suspicious audit log activity.