EUVD-2026-19701
GHSA-542q-mcfv-688v
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.
AnalysisAI
RunZero Explorer versions prior to 4.0.260208.0 allow high-privileged authenticated users to access Explorer groups outside their authorized organization scope, enabling unauthorized cross-organizational information disclosure and potential service disruption. The vulnerability stems from incorrect authorization controls (CWE-863) and requires administrator-level credentials and high attack complexity to exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | This vulnerability presents limited real-world risk despite its direct impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A runZero administrator in Organization A with high-level credentials could potentially enumerate or modify Explorer groups belonging to Organization B within the same runZero instance, assuming the instance supports multi-organization isolation and the attacker has detailed knowledge of the target organization's group identifiers. The high attack complexity requirement suggests this would require understanding internal API structures or group naming conventions; however, once an administrator authenticates, the authorization flaw could enable unauthorized cross-organizational access without additional user interaction. |
| Remediation | Upgrade runZero Explorer to version 4.0.260208.0 or later, which includes the authorization scope validation fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today