CVE-2026-2697 MEDIUM

CVE-2026-2697: Indirect Object Reference (IDOR) in Security Center

Vendor Tenable
Product Security Center
Weakness CWE-639 · IDOR
Published February 23, 2026
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.

Key dates

02Disclosure timeline

February 23, 2026 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13407 Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure CVE-2023-32799 WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) CVE-2025-12623 fushengqian fuint Authentication Token ClientSignController.java authorization CVE-2017-0936 CVE-2024-9263 WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover