Tenable Security Center CVE-2025-36636

Exploitation requires a valid authenticated Tenable Security Center account with limited (low-privilege) scope on an instance running a version prior to 6.7.0; the attacker leverages insufficient enforcement of authorization boundaries to reach resources outside their assigned scope. Limiting factors: an existing authenticated session is mandatory (PR:L - no anonymous/unauthenticated path), impact is confined to limited integrity (C:N/I:L/A:N per vendor), and the scope is unchanged (S:U). No user interaction is needed. The single vendor reference does not specify which features or object types are reachable out-of-scope, so the exact affected functionality is unconfirmed.

This is a low-to-moderate priority issue, not a critical one, and the signals are consistent on that. The CVSS 3.1 base score is 4.3 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - network-reachable and low-complexity, but requiring an existing authenticated low-privilege account (PR:L) and yielding only limited integrity impact with no confidentiality or availability impact per the vendor. EPSS reinforces low real-world risk at 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' One internal inconsistency should be verified with the vendor: the description says an authenticated user 'could access areas outside of their authorized scope,' which reads as a confidentiality (data-disclosure) issue, yet Tenable scored it C:N/I:L - implying the out-of-scope access manifests as unauthorized modification/action rather than reading. Treat the exact impact (read vs. write) as unconfirmed. Overall this is a horizontal/vertical authorization (CWE-284) weakness exploitable only by someone who already has valid credentials, which materially limits blast radius.

An authenticated low-privilege Tenable Security Center user (e.g., a scoped analyst or auditor) manipulates application requests to reach functionality, scan data, or organizational objects outside the scope they were granted. Because the flaw requires only an existing low-privilege session and low attack complexity, a malicious insider or an attacker with stolen/weak credentials could broaden their effective access without further privilege escalation. No public proof-of-concept exploit is known at time of analysis.