The vulnerability permits MCP agents to retrieve remediation and asset details that belong to other authorized organizations. It is a classic example of incorrect authorization, allowing privilege escalation to read sensitive data. The reported CVSS score reflects a medium severity scenario in which the attacker can obtain confidential asset information but cannot modify or delete data.

The affected product is runZero Platform, and the issue applies to all deployments prior to version 4.0.260202.0. Any instance installed before that release is vulnerable.

The CVSS score of 5.8 indicates a medium risk, and the absence of an EPSS score or KEV listing means there is no currently documented exploitation. However, the nature of the flaw (CWE‑863) suggests that an attacker who can gain MCP agent access could read data beyond their authorized scope. A patch is available, so timely application reduces risk.