runZero Platform EUVD-2026-115874

Requires an authenticated low-privileged account on the runZero platform (PR:L) with network access to the product's search feature; the attacker then submits a malformed search query that triggers the SQL injection and bypasses organization-level data isolation to read other organizations' results. The precise query construction that triggers the injection is not described in the available sources. Limiting factors: exploitation needs valid platform credentials (no unauthenticated path), impact is read-only confidentiality within the platform's data (no integrity/availability effect), and the only complete fix is upgrading to version 5.1.261013.1; the vendor's observation of 'only testing, no adversary traffic' is scoped to the hosted environment.

This is a medium-severity, authenticated information-disclosure flaw rather than a high-urgency, widely-exploited issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U, C:H/I:N/A:N, score 6.5) shows network-reachable, low-complexity exploitation by an attacker who already holds a valid low-privileged account (PR:L), with impact limited to confidentiality (cross-organization data exposure) and no integrity or availability effect. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. Crucially, the vendor states that log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic, so there is no confirmed active exploitation. The signals are internally consistent: a confirmed confidentiality bug in a multi-tenant SaaS, but gated behind authentication and with no evidence of real-world abuse. The vuln.today priority of 'this_month' aligns with that picture - patch in the normal cycle, not an emergency. The main thing to verify is deployment-mode coverage: the vendor's 'no adversary traffic' claim is specific to the HOSTED environment and does not speak to self-hosted deployments.

An attacker with a valid low-privileged account in one runZero organization submits a specially crafted malformed search query that abuses a SQL injection in the search backend, causing the query to return asset/scan results belonging to other organizations in the shared platform. No public exploit is identified; the vendor reports its hosted-environment logs showed only internal testing of the issue and no adversary traffic.