CVE-2026-87025: Authorization Bypass Through User-Controlled Key in Tanium Comply

This vulnerability in Tanium Comply allows an attacker with some level of privileges to bypass authorization controls by manipulating a user-controlled key. The flaw is due to improper access control mechanisms within the affected versions 2.32, 2.35, and 2.37. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact includes limited integrity and availability effects but no confidentiality loss.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially leading to limited integrity and availability impacts on the affected system. Confidentiality is not impacted. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Tanium's advisories for updates and apply patches once available. Until then, restrict access to affected versions and limit user privileges where possible.