CVE-2025-36636: Tenable Security Center Auth Bypass Flaw

CVE-2025-36636 Overview

CVE-2025-36636 is an improper access control vulnerability [CWE-284] in Tenable Security Center versions prior to 6.7.0. An authenticated user can access areas of the application outside of their authorized scope. The flaw allows horizontal or vertical boundary violations within the vulnerability management platform, potentially exposing scan data, asset information, or configuration surfaces intended for other roles.

The issue affects an enterprise vulnerability management product widely deployed to consolidate scan results and reporting. Because Tenable Security Center often holds sensitive findings across an entire estate, unauthorized access to restricted areas can expose infrastructure details useful to an internal attacker.

Critical Impact

An authenticated Tenable Security Center user can read data outside their authorized scope, undermining role-based access controls and exposing vulnerability intelligence to unauthorized personnel.

Affected Products

• Tenable Security Center versions prior to 6.7.0
• Deployments relying on role-based scope enforcement within Security Center
• Environments with multi-tenant or multi-team Security Center configurations

Discovery Timeline

• 2025-10-08 - CVE-2025-36636 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36636

Vulnerability Analysis

The vulnerability is categorized under [CWE-284: Improper Access Control]. Tenable Security Center enforces scope boundaries based on user role, group, and organizational assignment. In versions prior to 6.7.0, one or more application endpoints fail to consistently validate the requesting user's authorization against the target resource.

An authenticated user with valid session credentials can therefore reach functionality or data that should be restricted. The impact is limited to integrity of access boundaries and read exposure of in-scope data. Confidentiality impact is reported as none and availability is unaffected, but scope-restricted content becomes accessible to accounts that should not see it.

The vulnerability requires network access to the Security Center web interface and low-privilege authentication. No user interaction is required, and attack complexity is low.

Root Cause

The root cause is missing or incomplete authorization checks on server-side handlers. The application authenticates the session but does not consistently verify that the authenticated principal owns the requested resource or holds the required role. This pattern typically appears when access control is enforced at the UI layer rather than the API layer.

Attack Vector

An attacker requires a valid Security Center account. From there, the attacker manipulates request parameters, object identifiers, or endpoint paths to reference resources outside their assigned scope. The server processes the request without rejecting the out-of-scope reference.

Exploitation does not require chaining with other vulnerabilities. Tenable has not published technical details, and no public proof-of-concept is available. See the Tenable Security Center Release Notes for vendor guidance.

Detection Methods for CVE-2025-36636

Indicators of Compromise

• Security Center audit log entries showing a user accessing objects, scans, or reports outside their assigned organization or group.
• Unexpected API requests to resource identifiers that the requesting account has not previously queried.
• Session activity correlating a single low-privilege account with enumeration of sequential object IDs.

Detection Strategies

• Review Security Center application and audit logs for authorization anomalies, focusing on cross-organization or cross-repository access.
• Baseline normal access patterns per role and alert on deviations, such as analysts reading administrative configuration endpoints.
• Correlate web server access logs with user role assignments to identify requests that should have been denied.

Monitoring Recommendations

• Forward Tenable Security Center audit logs to a centralized SIEM for long-term retention and correlation.
• Implement alerting on repeated 200-status responses to endpoints tied to sensitive scope-restricted objects.
• Monitor account behavior for privilege boundary probing, particularly after user role changes or new account provisioning.

How to Mitigate CVE-2025-36636

Immediate Actions Required

• Upgrade Tenable Security Center to version 6.7.0 or later, which contains the fix for this vulnerability.
• Audit existing user accounts, roles, and organizational scope assignments to remove unnecessary access.
• Review recent audit logs to identify any historical out-of-scope access that may have occurred before patching.

Patch Information

Tenable resolved this issue in Security Center 6.7.0. Administrators should apply the upgrade following standard change management. Refer to the Tenable Security Center Release Notes for release contents and upgrade procedures.

Workarounds

• Restrict Security Center console access to trusted administrative networks using firewall or reverse proxy controls until the upgrade is complete.
• Reduce user privilege levels and remove inactive accounts to limit the population capable of exploiting the flaw.
• Enable and closely monitor Security Center audit logging to detect abnormal access patterns during the pre-patch window.

# Verify the installed Tenable Security Center version
/opt/sc/support/bin/sqlite3 /opt/sc/application.db "SELECT value FROM Configuration WHERE name='version';"