EUVD-2026-19703
GHSA-fj9r-v5j5-9xf4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.26021.0 of the runZero Platform.
AnalysisAI
Credential scope bypass in runZero Platform allows high-privileged administrators to update credentials and apply them to tasks outside their authorized organization scope, resulting in unauthorized information disclosure. The vulnerability affects runZero Platform versions prior to 4.0.26021.0 and requires administrative privileges to exploit. No public exploit code or confirmed active exploitation has been identified.
Technical ContextAI
The vulnerability stems from an authorization control failure (CWE-863: Incorrect Authorization) in the runZero Platform's credential management and task assignment functionality. The platform, identified by CPE cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*, uses organization scope as a boundary to segregate credentials and task access. The flaw allows high-privileged users to circumvent this organization-level isolation when updating credentials and associating them with tasks. This represents a multi-tenant authorization bypass where scope validation is insufficient during credential update operations.
RemediationAI
Upgrade runZero Platform to version 4.0.26021.0 or later immediately. This version contains the authorization control fix that properly enforces organization scope boundaries for credential updates and task assignments. For detailed patch information and release notes, consult the official runZero release notes at https://help.runzero.com/docs/release-notes/#402602100 and the security advisory at https://www.runzero.com/advisories/runzero-platform-cve-2026-5384/. No workarounds are available; patching is the only remediation.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today