This vulnerability (CWE-863) in Tenable Security Center permits a user assigned the "Security Manager" role with permission to manage users in a single group to escalate privileges by modifying users in other groups. This incorrect authorization bypasses access control restrictions designed to isolate group management, allowing unauthorized cross-group user modifications. The CVSS 3.1 score is 8.1 (high) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No patch or remediation level is currently documented, and no affected versions are specified.

An attacker with limited privileges (Security Manager role with manage user permission on one group) can escalate their privileges by modifying users in other groups, violating access control policies. This can lead to unauthorized changes to user accounts across groups, potentially compromising confidentiality and integrity of user management within the Security Center. Availability impact is not affected. No known active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict assignment of the Security Manager role and manage user permissions carefully to trusted administrators only. Monitor for unusual user management activities as a precaution.