CVE-2026-5378
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An issue in runZero Platform that allowed administrators to create and update users outside their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium). The issue was fixed in version 4.0.260203.0.
Risk Assessment
Incorrect authorization may allow administrators to manage user accounts in other organizations without permission, violating isolation and potentially leading to privilege escalation. This could result in unauthorized access to data or configuration.
Recommendation
Update runZero Platform to version 4.0.260203.0 or later. Also review administrator permissions and audit user account actions.
Other vulnerabilities in runZero Platform
See all- CVE-2026-81846Low
An authorization bypass vulnerability in the runZero Platform MCP service allows bypassing authorization through a user-controlled key (CWE-639). The issue is fixed in version 5.1.260826.0, with an estimated CVSS score of 3.5 (Low).
- CVE-2026-7778Medium
An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.
- CVE-2026-5384Medium
An issue in the runZero Platform that could allow a credential to be updated and used for a task outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).
- CVE-2026-5382Low
An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 3.0 (Low). The issue was fixed in version 4.0.260206.0 of the runZero Platform.
- CVE-2026-5381Low
An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 2.2 (Low). The issue was fixed in version 4.0.260205.0 of the runZero Platform.
- CVE-2026-5380Medium
An issue that could allow an authorized user to view clear-text secrets for a subset of credential types and fields has been resolved in the runZero Platform. This is an instance of CWE-522: Insufficiently Protected Credentials, with an estimated CVSS score of 5.3 (Medium). The issue was fixed in version 4.0.260204.2.
- CVE-2026-5379Low
An issue allowing MCP agents to access certificate information outside their authorized organization scope has been resolved. It is CWE-863 Incorrect Authorization with an estimated CVSS of 3.0 (Low), fixed in runZero Platform version 4.0.260203.0.
- CVE-2026-5376Medium
An issue in the runZero Platform that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is CWE-613: Insufficient Control of Resources After Expiration or Release, with an estimated CVSS score of 5.9 (Medium).
- CVE-2026-5375Low
An issue in the runZero Platform that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with an estimated CVSS score of 2.7 (Low). The issue was fixed in version 4.0.260203.0.
- CVE-2026-5374Medium
An issue in the runZero Platform that allowed MCP agents to access remediation and asset information outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).
Original NVD description (English source)
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N (5.8 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS