EUVD-2026-19703
GHSA-fj9r-v5j5-9xf4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.26021.0 of the runZero Platform.
AnalysisAI
Credential scope bypass in runZero Platform allows high-privileged administrators to update credentials and apply them to tasks outside their authorized organization scope, resulting in unauthorized information disclosure. The vulnerability affects runZero Platform versions prior to 4.0.26021.0 and requires administrative privileges to exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) reflects a 5.8 Medium severity despite confidentiality impact because exploitation requires high privileges (PR:H), high attack complexity (AC:H), and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator with high privileges but legitimately scoped to Organization A gains awareness of credentials belonging to Organization B (potentially through error messages, logs, or UI information leakage). The admin modifies or reassigns these credentials to a task under their control in Organization B, allowing them to execute reconnaissance or lateral movement within the cross-organization scope. … |
| Remediation | Upgrade runZero Platform to version 4.0.26021.0 or later immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today