[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_text _builder_version=\"4.27.6\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" theme_builder_area=\"post_content\" sticky_enabled=\"0\"]<\/p>\n
Product<\/strong>: Tenable Nessus Manager Tenable Nessus Manager is a vulnerability management platform designed to centrally coordinate vulnerability scanning. It provides a management layer for orchestrating scanners and administering Nessus Agents. Nessus Manager can remotely manage, update, and configure linked agents. Nessus Manager also provides functionality for retrieving logs from linked agents. Administrators can request agent logs, after which the agents push their log data back to the manager, where the collected logs can then be downloaded for analysis.<\/p>\n Insufficient access control mechanisms allow low-privileged user accounts to exploit the usd-2026-003<\/a>\u00a0vulnerability as well.<\/p>\n Users with the standard<\/strong> role have no access to the sensors tab in the web frontend and thus cannot normally download log files.<\/p>\n However, due to missing authorization checks, these low-privileged users can still send POST requests to \/agents\/download-log<\/strong> to generate a one-time token. The required agent-id is simply a sequentially incrementing number that can be easily guessed. They can then exploit this token via a GET request to \/tokens\/download<\/strong> to retrieve arbitrary files, as detailed in finding usd-2026-003<\/a>.<\/p>\n Implement comprehensive server-side authorization checks on all endpoints to enforce role-based access control. This security vulnerability was identified by Ole Wagner of usd AG.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2026-004 | Tenable Nessus Manager 10.11.1 - Missing Authorization (CWE-862) Product: Tenable Nessus ManagerAffected Version: 10.11.1Vulnerability Type: Missing Authorization (CWE-862)Security Risk: HighVendor: TenableVendor URL: https:\/\/www.tenable.com\/Vendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: CVE-2026-3493CVE Link: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-3493Advisory ID: usd-2026-004 Description Tenable Nessus Manager is a vulnerability management platform designed to centrally coordinate vulnerability scanning. It provides a management […]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-25093","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=25093"}],"version-history":[{"count":4,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25093\/revisions"}],"predecessor-version":[{"id":25100,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25093\/revisions\/25100"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=25093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Affected Version<\/strong>: 10.11.1
Vulnerability Type<\/strong>: Missing Authorization (CWE-862)
Security Risk<\/strong>: High
Vendor<\/strong>: Tenable
Vendor URL<\/strong>: https:\/\/www.tenable.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2026-3493
CVE Link<\/strong>: https:\/\/www.cve.org\/CVERecord?id=CVE-2026-3493<\/a>
Advisory ID<\/strong>: usd-2026-004<\/p>\nDescription<\/h3>\n
Once agents are linked, they receive scan instructions from the manager, perform assessments locally on the host system, and send results back to the manager.<\/p>\nProof of Concept<\/h3>\n
Fix<\/h3>\n
Validate user privileges against the specific action and resource before processing requests. Deny access if the user's role lacks permission, regardless of frontend restrictions.<\/p>\nReferences<\/h3>\n
\n
Timeline<\/h3>\n
\n
Credits<\/h3>\n