EUVD-2026-19698
GHSA-hm34-jchw-p8x7
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (2.2 Low). This issue was fixed in version 4.0.260205.0 of the runZero Platform.
AnalysisAI
runZero Platform versions prior to 4.0.260205.0 contain an incorrect authorization flaw that allows authenticated high-privileged users to access task information outside their authorized organization scope via network-based vectors with high complexity. The vulnerability is low-severity (CVSS 2.2) and limited to confidentiality impact (information disclosure), with no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-863 (Incorrect Authorization), a category of flaw where an application fails to properly validate that a user has permission to access requested resources. In this case, the runZero Platform's task information retrieval mechanism does not adequately enforce organization-level access controls, allowing high-privileged users authenticated to the system to query or retrieve task data belonging to other organizations. The network-based attack vector combined with high complexity suggests the exploitation requires specific conditions or knowledge of the platform's API/interface, but no special user interaction (UI:N) is needed once authenticated.
RemediationAI
Vendor-released patch: upgrade runZero Platform to version 4.0.260205.0 or later. This version includes the authorization controls fix to prevent cross-organization task information disclosure. Organizations should review the official runZero advisory at https://www.runzero.com/advisories/runzero-platform-task-infoleak-cve-2026-5381/ and release notes at https://help.runzero.com/docs/release-notes/#402602050 for deployment guidance. No interim workarounds are documented; patching is the primary remediation path.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today