Tanium Improper Access Control Vulnerability in Deploy and Patch Allowing Unauthorized Data Access

An improper access control vulnerability has been identified in Tanium's Deploy and Patch products, specifically in Deploy versions 2.26 prior to 2.26.1253, 2.30 prior to 2.30.150, and Patch versions 3.17 prior to 3.17.2262 and 3.19 prior to 3.19.195. This vulnerability could enable an authenticated Tanium user with certain permissions to gain unauthorized read-only access to restricted data. In the Deploy product, this pertains to deployment-related information, while in the Patch product, it relates to patch list data.

Impact

Exploitation of this vulnerability could result in unauthorized read access to sensitive deployment or patch-related data, depending on the affected product.