An improper access control flaw allows an authenticated user to reach areas of Tenable Security Center that fall outside their designated authorization scope. This creates a risk of exposing sensitive data or performing unauthorized configuration changes, potentially leading to data compromise or service disruption. The weakness maps to CWE-639, where user‑controlled keys enable bypass of intended access restrictions.

The vulnerability affects Tenable Security Center deployments that are not running the latest 6.8.0 release, as older versions lack the necessary controls. It applies to instances where users authenticate and can potentially access areas beyond their authorized scope. The description does not specify the default access model or require a particular role; therefore any authenticated role may be affected.

With a CVSS score of 5.7 the issue is considered moderate, while an EPSS score of less than 1% indicates a very low likelihood of widespread exploitation. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. The attack vector requires a legitimate user login with any valid role; from there the attacker can traverse beyond permitted boundaries. Due to the control requirement the risk is limited to compromised accounts but remains significant enough to warrant prompt mitigation.