What is the CVSS score of CVE-2026-5383?

CVE-2026-5383 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5383?

Yes, a patch is available for CVE-2026-5383. Update the affected software to the latest version immediately.

Explorer CVE-2026-5383

EUVD-2026-19701 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-07 runZero

GHSA-542q-mcfv-688v

Authentication Bypass Explorer Runzero

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260208.0

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19701

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:12 nvd

MEDIUM 4.4

DescriptionCVE.org

An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.

AnalysisAI

RunZero Explorer versions prior to 4.0.260208.0 allow high-privileged authenticated users to access Explorer groups outside their authorized organization scope, enabling unauthorized cross-organizational information disclosure and potential service disruption. The vulnerability stems from incorrect authorization controls (CWE-863) and requires administrator-level credentials and high attack complexity to exploit. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-863 (Incorrect Authorization), a class of flaws where access control decisions fail to properly validate user permissions against resource scope boundaries. In this case, runZero Explorer-a network discovery and asset inventory platform-incorrectly permits high-privileged users (PR:H per CVSS vector) to enumerate or access group resources that belong to different organizational contexts, bypassing the logical isolation that should segment multi-tenant or multi-organization deployments. The affected product is identified by CPE a:runzero:explorer, with all versions before 4.0.260208.0 vulnerable to this authorization bypass.

RemediationAI

Upgrade runZero Explorer to version 4.0.260208.0 or later, which includes the authorization scope validation fix. For organizations unable to immediately upgrade, restrict administrative access to trusted personnel and audit access logs for cross-organization group access attempts. Refer to the official advisory at https://www.runzero.com/advisories/runzero-explorer-cve-2026-5383/ for detailed remediation guidance and confirmation of patch deployment.