EUVD-2026-19694
GHSA-v27j-88v5-qwrq
5.8
CVSS 3.1
Share
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Lifecycle Timeline
3
Analysis Generated
Apr 07, 2026 - 15:00 vuln.today
EUVD ID Assigned
Apr 07, 2026 - 15:00 euvd
EUVD-2026-19694
CVE Published
Apr 07, 2026 - 14:11 nvd
MEDIUM 5.8
Description
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N (5.8 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.
Analysis
runZero Platform allows high-privileged administrators to create and update users outside their authorized organization scope due to improper authorization checks, enabling privilege escalation and cross-organizational user manipulation. Versions prior to 4.0.260203.0 are affected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
29
Low
Medium
High
Critical
KEV: 0
EPSS: +0.0
CVSS: +29
POC: 0
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).