EUVD-2026-19703
GHSA-fj9r-v5j5-9xf4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) reflects a 5.8 Medium severity despite confidentiality impact because exploitation requires high privileges (PR:H), high attack complexity (AC:H), and no user interaction. However, the scope change (S:C) and high confidentiality impact (C:H) indicate that a compromised admin account can leak sensitive data across organizational boundaries. Real-world risk is moderate: this is not a low-privilege escalation or unauthenticated attack, but a privilege misuse scenario where an existing admin could access credentials and tasks beyond their intended scope. Organizations with strict role-based access controls and admin activity monitoring will detect exploitation attempts. The fixed version availability reduces urgency but does not eliminate the risk for unpatched systems. |
| Exploit ScenarioDerived | An administrator with high privileges but legitimately scoped to Organization A gains awareness of credentials belonging to Organization B (potentially through error messages, logs, or UI information leakage). The admin modifies or reassigns these credentials to a task under their control in Organization B, allowing them to execute reconnaissance or lateral movement within the cross-organization scope. Detection would require audit logging of credential scope changes and admin activity monitoring. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Credential scope bypass in runZero Platform allows high-privileged administrators to update credentials and apply them to tasks outside their authorized organization scope, resulting in unauthorized information disclosure. The vulnerability affects runZero Platform versions prior to 4.0.26021.0 and requires administrative privileges to exploit. No public exploit code or confirmed active exploitation has been identified.
RemediationAI
Upgrade runZero Platform to version 4.0.26021.0 or later immediately. This version contains the authorization control fix that properly enforces organization scope boundaries for credential updates and task assignments. For detailed patch information and release notes, consult the official runZero release notes at https://help.runzero.com/docs/release-notes/#402602100 and the security advisory at https://www.runzero.com/advisories/runzero-platform-cve-2026-5384/. No workarounds are available; patching is the only remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from an authorization control failure (CWE-863: Incorrect Authorization) in the runZero Platform's credential management and task assignment functionality. The platform, identified by CPE cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*, uses organization scope as a boundary to segregate credentials and task access. The flaw allows high-privileged users to circumvent this organization-level isolation when updating credentials and associating them with tasks. This represents a multi-tenant authorization bypass where scope validation is insufficient during credential update operations.
Know when Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (runZero) · only source for this CVE.
CVSS VectorVendor: runZero
Lifecycle Timeline
2DescriptionCVE.org
An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.26021.0 of the runZero Platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
Exploit-DB