Tanium Comply CVE-2026-108302

Exploitation requires a valid authenticated Tanium Comply account at low privilege (CVSS PR:L) with network reachability to the Comply application (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific Comply feature, endpoint, or configuration that fails the authorization check is not described in the available sources, so the exact trigger is unverified. Limiting factors that reduce real-world risk: valid credentials are mandatory (this is not remote-unauthenticated), the affected product must be a vulnerable Comply build (2.32 before 2.32.263, 2.35 before 2.35.323, or 2.37 before 2.37.326), and impact is confined to reading data the account should not access - no write or denial-of-service capability.

This is a moderate, not an urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) improper-authorization flaw (CWE-863) in Tanium Comply whose only impact is limited confidentiality (C:L) - no integrity or availability effect. The vuln.today decision label is 'this_month', consistent with a real-but-contained issue rather than an emergency. Crucially, several escalation signals are ABSENT: there is no KEV listing, no EPSS probability was supplied, and no public exploit or PoC reference appears in the input, so exploitation likelihood cannot be quantified and should not be assumed high. The flaw was self-reported by the vendor (Tanium) with a patch already available, which argues for coordinated disclosure rather than active abuse. One data-quality tension: the 'Authentication Bypass' tag conflicts with the evidence - CWE-863 (incorrect authorization) plus PR:L means an already-authenticated low-privilege user over-reaches their permissions, which is an authorization/access-control defect, not an authentication bypass; treat the tag with caution. Net: a genuine but low-severity authenticated information-disclosure issue to remediate on a normal monthly cycle.

An attacker who already holds a valid low-privilege Tanium Comply account sends crafted requests over the network to resources the authorization logic should deny them, obtaining compliance information they are not entitled to see. No public exploit or PoC was identified in the available data, and the impact is limited to confidential data exposure (C:L) with no modification or disruption.