The vulnerability is an instance of incorrect authorization that permits the MCP endpoints to expose records outside the intended organization scope. This misauthorization can lead to the disclosure of confidential data, affecting confidentiality but not integrity or availability. The likely attack vector is via network access to the endpoints, exploiting the lack of proper authorization checks, as indicated by the CVSS vector AV:N. The CVSS score of 3.0 reflects a low risk severity but still represents a data confidentiality issue.

The issue affects the runZero Platform. Any deployment running a version prior to 4.0.260206.0 is potentially vulnerable, while versions 4.0.260206.0 and later include the fix.

This vulnerability has a low CVSS score of 3.0 and no EPSS data is available. It is not referenced in the CISA KEV catalog. Exploitation requires network accessibility to the MCP endpoints and the existence of a user with permissions to query those endpoints. The breach could allow an attacker to harvest records that they should not have access to, thereby violating data privacy constraints.