CVE-2026-5378: runZero Platform user creation leak

Q: What is the severity of CVE-2026-5378?

CVE-2026-5378 has an estimated CVSS score indicative of a high severity vulnerability due to it involving incorrect authorization.

Q: How do I fix CVE-2026-5378?

To resolve CVE-2026-5378, ensure that your runZero Platform is updated to version 4.0.260203.1 or later.

Q: Who is affected by CVE-2026-5378?

CVE-2026-5378 affects users of runZero Platform versions up to 4.0.260203.0.

Q: What type of vulnerability is CVE-2026-5378?

CVE-2026-5378 is classified under CWE-863, which refers to incorrect authorization.

Q: Can CVE-2026-5378 lead to data exposure?

Yes, CVE-2026-5378 can potentially lead to unauthorized access and modifications, which may expose sensitive data.

Published Apr 7, 2026

Updated

An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N (5.8 Medium). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

Affected Software

2 affected components

runZero runZero Platform<4.0.260203.0

Remediation

Information

This issue was fixed in version 4.0.260203.0 of the runZero Platform

Event History

Apr 7, 2026

CVE Published

via MITRE·02:11 PM

Data Sourced

via MITRE·02:11 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Aug 24, 58276

Event

via FIRST·11:32 PM

Frequently Asked Questions

What is the severity of CVE-2026-5378?

CVE-2026-5378 has an estimated CVSS score indicative of a high severity vulnerability due to it involving incorrect authorization.

How do I fix CVE-2026-5378?