The vulnerability allows a credential to be updated and then used for a task outside the authorized organization scope, effectively granting an attacker access to resources or actions they should not be able to perform. This flaw falls under Incorrect Authorization (CWE‑863) and could let a user leverage compromised or improperly scoped credentials to manipulate or access data within the platform. The impact is confined to confidentiality and integrity, with no direct denial‑of‑service effect reported.

The issue affects the runZero Platform for any version prior to 4.0.26021.0. Users running an older release should identify whether they are on a vulnerable build. No other vendors or products are explicitly listed as impacted.

The CVSS score of 5.8 indicates medium severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation. No EPSS score is available, so the likelihood of real‑world attacks remains uncertain. The attack vector is not explicitly stated, but given the nature of credential manipulation via the platform, it is likely achievable through API or web interfaces with elevated privileges. Appropriate auditing and segmentation of credentials can mitigate potential abuse.