A malformed search query in runZero's platform can trigger a SQL injection that returns data from outside a user’s organization. The flaw enables an attacker to retrieve confidential records that should be restricted, exposing sensitive information to unauthorized parties. The weakness corresponds to CWE‑89, a classic uncontrolled query construction vulnerability.

runZero Platform is affected, specifically versions prior to 5.1.261013.1. The fix was released in version 5.1.261013.1, so any instance running an older release is vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. Likely exploitation would occur through the search functionality exposed to authenticated users, making the attack vector indirect but feasible if user credentials are compromised or the search interface is publicly accessible.