Platform CVE-2026-5378

CVSS 5.8 (Medium) with vector AV:N/AC:H/PR:H/UI:N/S:C reflects a remote but difficult attack requiring high-privilege credentials, yet delivering integrity impact across organization boundaries (S:C scope change). The CVSS score appropriately captures the severity: while attack complexity is high and privilege requirement is high, the scope change from confidentiality/integrity perspective is notable in a multi-tenant platform context. Real-world risk depends heavily on deployment context: in environments where administrative role separation is strictly enforced as a security boundary, a malicious or compromised admin account could create unauthorized users in other organizations, potentially leading to lateral movement, data access, or organizational impersonation. However, this requires pre-existing high-privilege compromise, limiting the attack surface. No public exploit code has been identified, and there is no indication of active exploitation (no CISA KEV status provided). The vulnerability is most critical for organizations relying on runZero's multi-tenancy as a security isolation mechanism.

A malicious or compromised administrator with high-privilege credentials in Organization A could exploit this vulnerability to create or modify users in Organization B without proper authorization checks. For example, an attacker with admin access could programmatically call the user management API to add themselves as an administrator to a competing or sensitive organization within the same runZero Platform instance, gaining full control of that organization's network asset visibility and data. The attack requires network access to the platform and valid high-privilege credentials, but no user interaction is needed once those credentials are obtained.