CVE-2026-19639

Analyzed Analyzed - Analysis Complete

Improper Access Control in Application

Publication date: 2026-08-14

Last updated on: 2026-08-19

Assigner: Tenable Network Security, Inc.

Description

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-19639

EUVD

EUVD-2026-58738

Affected Vendors & Products

Vendor	Product	Version / Range
tenable	security_center	to 6.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue where an authenticated user without administrative privileges can view settings outside their assigned scope. This means non-admin users may access or modify data they should not be able to see.

Detection Guidance

This vulnerability involves improper access control for authenticated non-administrative users. Detection requires reviewing application logs for unauthorized access attempts to restricted settings and verifying user permissions. No specific commands are provided in the context.

Impact Analysis

This could lead to unauthorized data exposure or modification. For users, it may mean sensitive information becomes accessible to unauthorized individuals. For organizations, it risks data breaches, compliance violations, and loss of trust.

Compliance Impact

This vulnerability could violate data protection requirements in GDPR and HIPAA by allowing unauthorized access to sensitive data. Organizations may face fines, legal penalties, and reputational damage if such access controls are not properly enforced.

Mitigation Strategies

Implement strict access controls to ensure authenticated non-administrative users cannot view settings outside their assigned scope. Review and update user permissions regularly.

Hi! I’m here to help you understand CVE-2026-19639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70