CVE-2026-81846

Published: Sep 1, 2026Modified: Sep 9, 2026Deferred

3.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: 44488dab-36db-4358-99f9-bc116477f914 (Secondary)

Description

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://help.runzero.com/docs/release-notes/#512608260

Source: 44488dab-36db-4358-99f9-bc116477f914

https://www.runzero.com/advisories/runzero-mcp-findings-summaries-data-leak-cve-2026-81846

Source: 44488dab-36db-4358-99f9-bc116477f914

Timeline

No history available yet.