Tanium Discover CVE-2026-116669

Exploitation requires an authenticated, low-privileged account on Tanium Discover (PR:L); it is not exploitable by fully unauthenticated attackers. The flaw is an improper access-control / CWE-639 authorization bypass, meaning the attacker abuses a user-controlled identifier or key to reach data belonging to other users or scopes; the precise feature or endpoint and the exact trigger are not described in the available sources. Limiting factors that reduce real-world risk: valid Discover credentials are needed, impact is confined to confidentiality (no data modification or service disruption), and no user interaction or special non-default configuration is indicated by the data provided.

This is a moderate-severity authorization flaw, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity issue that nonetheless requires an authenticated low-privileged account (PR:L) and yields confidentiality-only impact (C:H, I:N, A:N) - consistent with CWE-639 (authorization bypass through a user-controlled key / IDOR), where an authenticated user reads data they should not. The vuln.today Decision label is 'this_month' rather than act_now or emergency, aligning with the medium technical severity. No EPSS score was supplied, the CVE is not in CISA KEV, and no proof-of-concept or exploit reference was provided (the single reference is the Tanium vendor advisory), so there is no public signal of active or imminent exploitation. The principal risk driver is that an attacker needs valid Discover credentials, which pushes the realistic threat toward malicious insiders or adversaries who have already harvested low-privilege credentials rather than opportunistic unauthenticated internet scanning. One note of caution: the input Tags label this 'Authentication Bypass,' but PR:L and CWE-639 indicate authentication is required and the weakness is an authorization (access-control) bypass - verify the distinction, as it materially changes who can exploit it.

A low-privileged but authenticated Tanium Discover user manipulates a user-controlled resource identifier (CWE-639) to retrieve asset or inventory data belonging to other users, roles, or tenants they are not authorized to view. Because the vector is network-based with low attack complexity (AV:N/AC:L) and no user interaction, the request can be issued directly against the service once logged in. No public exploit code was identified, and the exact mechanism to trigger the bypass is not described in the available sources.