EUVD-2026-69554
GHSA-29cr-9cjx-c8cg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Network-accessible API requiring an authenticated account (PR:L), high complexity to enumerate cross-tenant keys (AC:H), scope change as authorization boundary is crossed (S:C), limited confidentiality only (C:L).
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
Lifecycle Timeline
2DescriptionCVE.org
An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).
AnalysisAI
Authorization bypass in the runZero Platform MCP service allows an authenticated network attacker to read findings summaries belonging to other users or organizations by manipulating a user-controlled key in API requests. Affected versions of the platform prior to 5.1.260826.0 are exposed; the vendor has resolved the issue in that release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account on the runZero Platform (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade runZero Platform to version 5.1.260826.0 or later, which resolves the authorization bypass per the vendor advisory at https://www.runzero.com/advisories/runzero-mcp-findings-summaries-data-leak-cve-2026-81846. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
Share
External POC / Exploit Code
Leaving vuln.today