{"id":"CVE-2026-119317","title":"Incorrect Authorization","summary":"On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","vendor":"Tenable, Inc.","product":"Plugin Feed","affected":["plugin_feed < 202610282338"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T17:06:57.763805Z"},"published":"2026-10-29","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:07:23.004Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119317","references":[{"url":"https://www.tenable.com/security/tns-2026-33"}],"tags":["cve.org"],"epss":0.00222,"epssPercentile":0.12799,"ingestedAt":"2026-11-05T16:24:31.130Z","slug":"CVE-2026-119317","body":"## Overview\n\nOn Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.\n\n## Affected\n\n- `plugin_feed < 202610282338`\n\n## Remediation\n\nTenable has released updates to Plugins to resolve the issue. The updates have been distributed via the Tenable plugin feed in Feed Serial Numbers equal to or greater than #202610282338.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}