VulnerabilityAnalyzed

CVE-2026-5381

An issue that could expose task information outside of the authorized organization scope has been resolved.

LOW 2.2EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (2.2 Low). This issue was fixed in version 4.0.260205.0 of the runZero Platform.

CVSS 3.1: 2.2 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: runzero/runzero platform
Source: 44488dab-36db-4358-99f9-bc116477f914

References

https://help.runzero.com/docs/release-notes/#402602050Release Notes
https://www.runzero.com/advisories/runzero-platform-task-infoleak-cve-2026-5381/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.