Runzero

**Name of the Vulnerable Software and Affected Versions** runZero Platform MCP service versions prior to 5.1.260826.0 **Description** An authorization bypass exists in the MCP service. This issue is an instance of Authorization Bypass Through User-Controlled Key, which occurs when an application uses a user-supplied input to access a resource without properly verifying if the user is authorized to access that specific resource. **Recommendations** Update to version 5.1.260826.0.

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260202.0 Description A flaw allowed MCP agents to access remediation and asset information outside of authorized organizational boundaries. This is categorized as incorrect authorization. Recommendations Update to version 4.0.260202.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260203.0 Description A flaw exists that may allow a user with existing credentials to view sensitive information through an API response. This is categorized as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Recommendations Update to version 4.0.260203.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260203.0 Description A flaw exists that could prevent session inactivity timeouts from triggering due to automatic page reloading. This is due to insufficient control of resources after expiration or release. Recommendations Update to version 4.0.260203.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260203.0 Description An issue allowed administrators to create and update users outside of their authorized organization scope. This is an instance of CWE-863: Incorrect Authorization. Recommendations Update to version 4.0.260203.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260203.0 Description A flaw allowed MCP agents to access certificate information beyond their authorized organizational boundaries. This is categorized as CWE-863: Incorrect Authorization. Recommendations Update to version 4.0.260203.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions 4.0.260123.0 Description A SQL injection attack vector related to saved queries was identified. The issue was introduced in version 4.0.260123.0 and is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Recommendations Update to version 4.0.260123.1 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260205.0 Description The software contains an authorization issue that could expose task information outside of the authorized organization. This is due to incorrect authorization (CWE-863). Recommendations Update to version 4.0.260205.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260206.0 Description The software contains an authorization issue that could expose records outside of the authorized organization scope through the MCP endpoints. The issue is classified as CWE-863: Incorrect Authorization. Recommendations Update to version 4.0.260206.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Explorer versions prior to 4.0.260208.0 Description A flaw exists that could allow unauthorized access to Explorer groups. This is due to incorrect authorization. Recommendations Update to version 4.0.260208.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.26021.0 Description A flaw exists that could permit unauthorized modification and use of credentials outside the intended organizational boundaries. This is categorized as CWE-863: Incorrect Authorization. Recommendations Update to version 4.0.26021.0 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260204.2 Description A security issue allows an authorized user to view clear-text secrets for certain credential types and fields. Recommendations Update to version 4.0.260204.2 or later.

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260202.0 Description A flaw allowed all-organization administrators to elevate accounts to superuser status. This is due to improper privilege management. Recommendations Update to version 4.0.260202.0 or later.