CVE-2026-5378

CVE-2026-5378 is an authorization bypass vulnerability in the runZero Platform that allows high-privileged administrators to create and update user accounts outside their authorized organizational scope. The flaw stems from improper access controls (CWE-863) and was resolved in platform version 4.0.260203.0. The vulnerability carries a CVSS 3.1 score of 6.8 (Medium severity) with a network-based attack vector requiring high privileges and no user interaction. The primary impact is integrity compromise, enabling unauthorized user account manipulation across organization boundaries, with a cross-system scope. Attack complexity is low, indicating straightforward exploitation once authentication is obtained. There is currently no evidence of active exploitation, as the vulnerability is not listed on the CISA KEV catalog and remains inactive on public exploit tracking lists. The EPSS score of 0.000410 indicates minimal current exploitation probability in the wild, suggesting limited community attention and exploit code availability at this time.