Platform CVE-2026-5381

While the CVSS score of 2.2 is low, the risk assessment must account for multiple data points: (1) the vector shows authentication is required (PR:H, high-privilege user), significantly limiting the attack surface; (2) attack complexity is high (AC:H), meaning successful exploitation requires specific conditions; (3) impact is limited to confidentiality with only low-level information disclosure (C:L); (4) no KEV (CISA Known Exploited Vulnerabilities) status is indicated, and no public exploit code is referenced; (5) the defect affects task metadata rather than critical system functions or credentials. This is a genuine but constrained authorization bypass relevant primarily to organizations with multi-tenant or multi-org deployments of runZero where administrative users might maliciously or inadvertently probe cross-organization data. Real-world risk is proportional to the sensitivity of task information and the trustworthiness of high-privilege users within each organization.

A high-privileged administrator within one organization of a multi-tenant runZero deployment could craft API requests or use the platform interface to enumerate or retrieve task information from other organizations within the same instance. While the high authentication barrier (PR:H) and high complexity (AC:H) limit the likelihood, an insider with administrative privileges or a compromised admin account could use this flaw to conduct corporate espionage or gather sensitive information about other organizations' network scanning activities. No public proof-of-concept or active exploitation is known.