Description

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-14T18:17:22.557Z",
  "pubdate": "2026-08-14T18:17:22.557Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in Tenable Security Center involving an authorization bypass within the user management subsystem. The flaw specifically impacts the access control enforcement mechanisms governing role-based permissions across distinct user groups. Specifically, an authenticated user assigned the 'Security Manager' role and endowed with 'manage user' permissions scoped strictly to a single, isolated group is capable of modifying user accounts belonging to entirely separate and unauthorized groups. This breakdown in security boundaries introduces significant risk implications, as lower-privileged administrators can effectively escalate their administrative control beyond their intended organizational domain, potentially compromising the integrity and security of the broader user directory. The exploitation of this vulnerability requires prior authentication with specific administrative privileges, relying on a flaw in server-side authorization checks rather than sophisticated memory corruption or external injection vectors. The impact centers on unauthorized cross-group user management, violating the principle of least privilege and multi-tenancy isolation within the affected software product.",
  "technicalDetails": "The root cause of this vulnerability lies in an inadequate authorization validation check within the Tenable Security Center backend application logic when processing administrative user modification requests. In a correctly implemented multi-tenant or scoped-permission architecture, the application should validate that the actor initiating a modification request possesses administrative scope over the targeted user entity's assigned group. However, the vulnerable component fails to adequately enforce this boundary for users holding the 'Security Manager' role who possess the 'manage user' permission within a constrained group context.\nThe attack flow proceeds as follows: First, the threat actor authenticates to the Tenable Security Center web interface using valid credentials associated with a 'Security Manager' role restricted by permissions to a single, designated user group. Second, the attacker initiates an administrative request to modify properties, attributes, or role assignments of a user account. By manipulating the target user identifier within the API request or parameter payload—specifically targeting a user entity belonging to a separate group outside the attacker's administrative domain—the attacker bypasses the intended boundary checks. Third, the backend application processes the modification request without verifying whether the requesting 'Security Manager' maintains administrative jurisdiction over the targeted user's group association. Consequently, the database transaction successfully updates the foreign user record.\nThe exploitation method relies on parameter manipulation and insecure direct object reference or missing function-level access control paradigms within the user management interface. The prerequisite conditions demand that the attacker already holds authenticated access with specific scoped privileges ('Security Manager' role with 'manage user' capability on a single group). The network exposure is dictated by the standard deployment interface of Tenable Security Center, typically accessible via HTTP/HTTPS services exposed to administrative users. The post-exploitation impact includes unauthorized modification of user accounts, potential takeover of administrative or higher-privileged accounts residing in other groups, and complete compromise of the logical access control segregation enforced within the platform."
}