PT-2026-30873 · Unknown · Runzero Platform

Runzero · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-5378

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260203.0

Description An issue allowed administrators to create and update users outside of their authorized organization scope. This is an instance of CWE-863: Incorrect Authorization.

Recommendations Update to version 4.0.260203.0 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-5378

Affected Products

Runzero Platform

References · 5

• https://runzero.com/advisories/runzero-platform-user-creation-leak-cve-2026-5378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5378 · Security Note
• https://help.runzero.com/docs/release-notes/#402602030 · Note
• https://twitter.com/infoflowcloud/status/2041604763708449223 · Twitter Post
• https://twitter.com/CVEnew/status/2041603255571042337 · Twitter Post