An unauthorized actor can access API responses and view sensitive fields if the user has credential access. The flaw represents an exposure of confidential information, allowing potential disclosure of data that should be protected. The weakness is classified as CWE-200, indicating a lack of proper access controls for sensitive data stored or transmitted by API responses. The primary consequence is the compromise of confidentiality of credential information, while integrity and availability remain unaffected.

The vulnerability affects runZero Platform versions older than 4.0.260203.0. All installations of runZero Platform running a version prior to this release are susceptible. The issue is resolved by updating to 4.0.260203.0 or later.

The CVSS score is 2.7, indicating a low risk severity. Exploitability is limited to users who already possess credential access, meaning an insider or privileged user could exploit it. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently targeted by widespread exploitation. The attack vector is inferred to be network-based, requiring legitimate access to the API. Overall, the risk is low but mitigated by the required high privileges to exploit.