CVE-2026-87047: Authorization Bypass Through User-Controlled Key in Tanium Comply

This vulnerability in Tanium Comply involves improper access controls that allow an authorization bypass via a user-controlled key. The CVSS 3.1 base score is 6.3, indicating a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact includes limited confidentiality, integrity, and availability impacts. The affected versions are exactly 2.32, 2.35, and 2.37. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability could allow an attacker with low privileges to bypass authorization controls, potentially leading to limited unauthorized access or modification of data and limited disruption of service. The CVSS vector indicates that the attack can be performed remotely over the network with low complexity and no user interaction, but requires some privileges. The overall impact is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Tanium's advisories for updates. Until a fix is available, restrict access to affected versions and apply principle of least privilege to limit potential exploitation.