What is the CVSS score of CVE-2026-5378?

CVE-2026-5378 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5378?

Yes, a patch is available for CVE-2026-5378. Update the affected software to the latest version immediately.

Platform CVE-2026-5378

EUVD-2026-19694 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-07 runZero

GHSA-v27j-88v5-qwrq

Authentication Bypass Platform Runzero

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260203.0

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19694

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:11 nvd

MEDIUM 5.8

DescriptionCVE.org

An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N (5.8 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

AnalysisAI

runZero Platform allows high-privileged administrators to create and update users outside their authorized organization scope due to improper authorization checks, enabling privilege escalation and cross-organizational user manipulation. Versions prior to 4.0.260203.0 are affected. The vulnerability requires high-privilege authentication but can impact multiple organizations within a multi-tenant deployment, making it a significant risk for runZero deployments where administrative role separation is enforced.

Technical ContextAI

The runZero Platform implements a multi-tenant architecture with per-organization administrative boundaries. The vulnerability stems from CWE-863 (Incorrect Authorization), where user creation and update operations fail to properly validate whether the authenticated administrator holds authorization scope over the target organization. This represents a classic authorization bypass in a role-based access control (RBAC) system, where the application authenticates the admin user but fails to enforce organization-level boundaries on sensitive administrative operations. Affected versions of the runZero Platform (CPE: cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*) prior to 4.0.260203.0 contain this flaw in their user management API or administrative interface.

RemediationAI

Vendor-released patch: Upgrade to runZero Platform version 4.0.260203.0 or later. Organizations should prioritize this patch in environments where multiple organizations or tenants are managed through a single runZero Platform instance, as the authorization bypass directly impacts multi-tenant isolation. Refer to the official runZero advisory at https://www.runzero.com/advisories/runzero-platform-user-creation-leak-cve-2026-5378/ and release notes at https://help.runzero.com/docs/release-notes/#402602030 for upgrade instructions. Until patched, restrict administrative account access to trusted personnel and monitor user creation/update logs for anomalies.