Greenbone Security Assistant access is a GMP permission problem

Greenbone Security Assistant is the web interface for a vulnerability management stack. The login page is only the first control. What a user can see and change is enforced through Greenbone Management Protocol permissions, so a web-only review can easily miss the authority behind a familiar menu.

On 9 November 2026 at 07:51 Asia/Shanghai, ZoomEye returned 3,026 matches for app="Greenbone Security Assistant" with sub_type=all, page 1, and page size 1. The title query returned 2,947 and a body query returned 20,799. The app and title values are close; the body count is less specific.

The selected query preserves the exact dork.

The role is enforced below the interface

Greenbone's appliance documentation states that role enforcement is implemented in GMP rather than in the web interface alone, which affects every GMP client. That is a useful design property: a direct API client and the web console should be constrained by the same permission model.

The interface gives users access to scan configuration, targets, results, reports, and user management. Some users need to run scans and read findings. Others need to manage scan configs or the appliance itself. A role name that looks read-only should be tested against the API and against report export, not only against a hidden button.

When more than one role is assigned, the documentation says the role permissions are added. Permission union is common, but it is easy to overlook during a quarterly review. A user with a temporary role can retain a larger effective permission set than the role name suggests.

Check identity and report sensitivity

The appliance supports local authentication and external authentication services. A user must still exist on the appliance and be configured for the selected authentication method. Review the joiner, mover, and leaver process for both the identity provider and the Greenbone user record.

Reports can contain host names, IP addresses, service banners, vulnerability evidence, and remediation status. A report export is therefore a data movement event, not a harmless download. Restrict report formats and destinations, and log exports with the user, report range, task, and time.

If the deployment uses a scan sensor or a separate management node, inspect the trust relationship between them. The web console may be reachable from a management network while the scanner has routes to sensitive segments. A user who can create a target can direct the scanner toward those segments.

Test the web and GMP paths together

Use a test account with the intended operational role. Perform a scan, view a result, export a report, and attempt a user-management action. Then use the corresponding GMP client with the same account and confirm that the permission decision is consistent. Record the command or API operation and the returned authorization result.

Review default and shared accounts. Remove or rotate setup credentials, and avoid a single admin account used by several operators. If automation needs an account, give it a dedicated identity and document which tasks it can create or modify.

Place the web interface on a management plane with access logging and an allowlist where possible. If the product must be reachable by a remote workforce, use a strong identity proxy and keep the GMP endpoint behind the same review. Exposing the web UI while leaving the GMP service open on another port is not a coherent boundary.

A practical next step

Use the 3,026 app matches as an inventory lead. For each owned system, compare the visible role menu with the effective GMP permission and the scanner's network reach. Test one report export and one scan-target change with a role that should not be allowed to perform it.

Greenbone is designed to find exposure across a network. Its own access model should be reviewed with the same specificity: which identity, which GMP permission, which scanner route, and which report data. That is a more useful review than checking whether the login page exists.

References

• Greenbone documentation, Managing the Web Interface Access
• Greenbone documentation, Architecture
• Greenbone documentation, Getting to Know the Web Interface