EUVD-2026-19701
GHSA-542q-mcfv-688v
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L (4.4 Medium). This issue was fixed in version 4.0.260208.0 of the runZero Explorer.
AnalysisAI
RunZero Explorer versions prior to 4.0.260208.0 allow high-privileged authenticated users to access Explorer groups outside their authorized organization scope, enabling unauthorized cross-organizational information disclosure and potential service disruption. The vulnerability stems from incorrect authorization controls (CWE-863) and requires administrator-level credentials and high attack complexity to exploit. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-863 (Incorrect Authorization), a class of flaws where access control decisions fail to properly validate user permissions against resource scope boundaries. In this case, runZero Explorer-a network discovery and asset inventory platform-incorrectly permits high-privileged users (PR:H per CVSS vector) to enumerate or access group resources that belong to different organizational contexts, bypassing the logical isolation that should segment multi-tenant or multi-organization deployments. The affected product is identified by CPE a:runzero:explorer, with all versions before 4.0.260208.0 vulnerable to this authorization bypass.
RemediationAI
Upgrade runZero Explorer to version 4.0.260208.0 or later, which includes the authorization scope validation fix. For organizations unable to immediately upgrade, restrict administrative access to trusted personnel and audit access logs for cross-organization group access attempts. Refer to the official advisory at https://www.runzero.com/advisories/runzero-explorer-cve-2026-5383/ for detailed remediation guidance and confirmation of patch deployment.
Explorer32++ 1.3.5.531 has a buffer overflow in filename handling that corrupts the SEH chain with filenames over 396 ch
Buffer overflow vulnerability in Explorer++ affecting version 1.3.5.531. Rated high severity (CVSS 7.8), this vulnerabil
Directory traversal vulnerability in the Speed Root Explorer application before 3.2 for Android and the Speed Explorer a
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today