The vulnerability in runZero Explorer allows an attacker to view or interact with Explorer groups that fall outside the authorized organization scope. Because the application fails to enforce proper authorization checks, the flaw falls under CWE‑863, Incorrect Authorization. Although the CVSS scoring predicts low impact on confidentiality and higher impact on integrity, the ability to access groups where the attacker does not have permission can lead to unauthorized data visibility and potential manipulation of group settings.

RunZero Explorer versions prior to 4.0.26021.0 (the vendor notes that the issue was also fixed in 4.0.260208.0) runZero Explorer is the affected product. Anyone deploying these earlier builds is susceptible to the flaw.

The CVSS 3.1 score of 4.4 classifies the issue as medium severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, indicating that it is not a known exploited weakness at this time. The likely attack vector is through the web interface, where an unauthenticated or low‑privilege user can request group data that should be restricted.