An indirect object reference flaw allows an authenticated remote attacker to manipulate the 'owner' parameter in Tenable Security Center. This can elevate the attacker's privileges, granting access to resources beyond their authorized scope. The weakness aligns with CWE‑639, indicating that access controls do not correctly validate ownership of referenced objects.

Tenable Security Center, all releases prior to version 6.8.0 are affected. The product is identified as tenable:security_center in the CPE feed. No precise version list is provided, but the public advisory states that the fix is included in the 6.8.0 release.

The vulnerability has a CVSS score of 2.1, reflecting a low base severity, and an EPSS score of less than 1%, indicating that exploitation is expected to be rare. The flaw is not listed in the KEV catalog. The attack requires an authenticated session, suggesting the likely vector is a remote attacker who has obtained legitimate credentials. No additional exploitation requirements are stated, so the risk remains limited but the ability to raise privileges renders it a potentially critical concern for environments where privilege separation is essential.