Search
Find a vulnerability
Search criteria
2 vulnerabilities by moghtech
CVE-2026-82267 (GCVE-0-2026-82267)
Vulnerability from nvd – Published: 2026-08-28 16:18 – Updated: 2026-08-31 18:55
VLAI
EPSS
VEX
Title
Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Summary
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1455 | issue-tracking |
| https://github.com/moghtech/komodo | product |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://www.vulncheck.com/advisories/komodo-resou… | third-party-advisory |
Date Public
2026-06-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:33.405719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:55:11.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:18:51.391Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1455",
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1455"
},
{
"tags": [
"product"
],
"url": "https://github.com/moghtech/komodo"
},
{
"name": "Vulnerable code: update.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/helpers/update.rs"
},
{
"name": "Vulnerable code: mod.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/api/execute/mod.rs"
},
{
"name": "VulnCheck Advisory: Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-resource-identifier-disclosure-and-audit-log-pollution-before-permission-check"
}
],
"title": "Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82267",
"datePublished": "2026-08-28T16:18:51.391Z",
"dateReserved": "2026-08-28T11:12:37.404Z",
"dateUpdated": "2026-08-31T18:55:11.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82267 (GCVE-0-2026-82267)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:18 – Updated: 2026-08-31 18:55
VLAI
EPSS
VEX
Title
Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Summary
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/moghtech/komodo/issues/1455 | issue-tracking |
| https://github.com/moghtech/komodo | product |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://github.com/moghtech/komodo/blob/cc1c5aa5d… | technical-description |
| https://www.vulncheck.com/advisories/komodo-resou… | third-party-advisory |
Date Public
2026-06-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:33.405719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:55:11.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "komodo",
"vendor": "moghtech",
"versions": [
{
"lessThanOrEqual": "2.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:18:51.391Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1455",
"tags": [
"issue-tracking"
],
"url": "https://github.com/moghtech/komodo/issues/1455"
},
{
"tags": [
"product"
],
"url": "https://github.com/moghtech/komodo"
},
{
"name": "Vulnerable code: update.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/helpers/update.rs"
},
{
"name": "Vulnerable code: mod.rs",
"tags": [
"technical-description"
],
"url": "https://github.com/moghtech/komodo/blob/cc1c5aa5dabb738e843c47f5e87fc040648c2bb7/bin/core/src/api/execute/mod.rs"
},
{
"name": "VulnCheck Advisory: Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/komodo-resource-identifier-disclosure-and-audit-log-pollution-before-permission-check"
}
],
"title": "Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82267",
"datePublished": "2026-08-28T16:18:51.391Z",
"dateReserved": "2026-08-28T11:12:37.404Z",
"dateUpdated": "2026-08-31T18:55:11.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}