Sensitive Information Exposure in RunZero Platform API
CVE-2026-5375

2.7LOW

Key Information:

Vendor

Runzero

Status
Platform
Vendor
CVE Published:
7 April 2026

What is CVE-2026-5375?

A vulnerability has been identified in the RunZero Platform that permits users with appropriate credentials to inadvertently access sensitive fields through an API response. This flaw can lead to unauthorized exposure of confidential data, posing a risk to the integrity and privacy of information handled within the platform. The issue has been addressed in version 4.0.260203.0, ensuring that sensitive data is adequately protected against unauthorized access.

Affected Version(s)

Platform 0 < 4.0.260203.0

References

https://help.runzero.com/docs/release-notes/#402602030
release-notes
https://www.runzero.com/advisories/runzero-platform-api-c...
vendor-advisory

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

runZero
.