EUVD-2026-67798
GHSA-mhh4-h87m-4g62
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requiring authenticated session (PR:L); low confidentiality impact from identifier leakage and low integrity impact from audit log falsification; no availability or scope-change impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
AnalysisAI
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Komodo session with at least low-privileged user credentials, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated access is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N reflects a medium-severity, network-exploitable flaw requiring a valid authenticated session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a confirmed fixed version is identified in the available reference data; operators should monitor the upstream repository at https://github.com/moghtech/komodo for a release that corrects the authorization ordering in the execute handler and update helper. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today