Platform EUVD-2026-19636

The CVSS score of 2.7 (Low severity) reflects multiple mitigating factors: the attack requires high privileges (PR:H), network attack vector is available (AV:N) but low complexity (AC:L), and the impact is limited to confidentiality (C:L) with no integrity or availability damage (I:N/A:N). However, CVSS alone is misleading here. An insider threat or account compromise scenario elevates real-world risk substantially-a high-privileged user (administrator, service account, or compromised API token) can enumerate and exfiltrate credential data that should be opaque at the API layer. The information disclosure impact is amplified in environments where credentials are reused across systems or where the leaked credentials grant access to other critical infrastructure. SSVC analysis favors patching: this is exploitable by insiders, the technical impact is straightforward (unauthorized data access), and automatable scanning/exfiltration is feasible once API endpoints are identified. While not remotely exploitable by unauthenticated attackers, the presence of administrative accounts, leaked API tokens, or lateral movement from compromised workstations makes this a practical security concern despite the low CVSS score.

An administrator whose credentials or API token are compromised by phishing or malware can query the runZero Platform API to retrieve stored credentials including usernames, passwords, tokens, or other sensitive authentication material that should be redacted in API responses. Alternatively, a disgruntled insider with high-privilege access can systematically export credential data from the platform to exfiltrate intellectual property or enable lateral movement to external systems that rely on the same credentials. This scenario requires the attacker to already hold high-privilege credentials, but the ease of API-based bulk exfiltration (combined with low complexity) makes this a practical post-compromise attack vector.