runZero Platform EUVD-2026-27331

Exploitation requires: (1) valid authenticated credentials to the runZero Platform (PR:L); (2) network access to the platform's API endpoints (AV:N, AC:L); (3) knowledge or enumeration of dashboard identifiers or organization scopes belonging to other organizations; (4) the target organization's dashboard configurations must exist and be queryable via the affected endpoint. The vulnerability does NOT require user interaction (UI:N) or special privileges beyond standard authenticated user roles. Non-default configurations do not limit exploitation-the flaw exists in the default authorization logic of the core platform. The primary limiting factor is the requirement for valid authentication; unauthenticated attackers cannot exploit this vulnerability.

CVSS score of 5.0 (Medium) with network vector (AV:N), low complexity (AC:L), and low privileges required (PR:L) indicates broad network accessibility requiring only standard authenticated user credentials. The scope change (S:C) to confidentiality impact (C:L) signals a meaningful but contained information disclosure risk. EPSS data not provided, limiting real-world exploitation probability assessment beyond CVSS signals. The vulnerability is not listed in CISA KEV, and no public POC has been identified at time of analysis, suggesting this is a measured disclosure rather than an actively weaponized threat. However, authenticated users are common in enterprise environments, and the low privilege requirement combined with network vector creates realistic attack surface for internal threat actors or compromised low-privilege accounts. Risk severity is proportional to the sensitivity of dashboard configurations stored in affected deployments and the scale of multi-tenant organization deployments.

An authenticated user with standard low-privilege credentials (e.g., a junior analyst account) in Organization A sends a crafted API request to the dashboard configuration endpoint targeting Organization B's dashboard ID. Due to insufficient authorization checks, the platform returns Organization B's dashboard configuration-potentially containing sensitive queries, data filters, asset groupings, and monitoring rules specific to Organization B-allowing unauthorized cross-organization intelligence gathering.