CVE-2026-5383

CVE-2026-5383 is an authorization bypass vulnerability in runZero Explorer that allows users to access Explorer groups outside their authorized organization scope. The issue was classified as CWE-863: Incorrect Authorization and has been patched in version 4.0.260208.0. The vulnerability carries a CVSS 3.1 score of 4.4 (Medium severity) with network-based attack vector, high attack complexity, and high privilege requirements. While confidentiality impact is negligible, the flaw enables integrity and availability impacts across system boundaries, suggesting potential for data manipulation or service disruption within affected multi-tenant environments. Exploitation status remains minimal with no evidence of active exploitation or public exploit code availability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog and maintains an inactive status on industry hot lists. The EPSS score of 0.0006 indicates a very low probability of exploitation in the wild, suggesting this represents a low immediate threat to organizations.