The vulnerability is an instance of improper privilege management that permits a dashboard configuration to be accessed from outside the authorized organization scope. This flaw, rated CVSS 5.0 Medium, would enable an attacker to view sensitive configuration details, potentially giving insight into system topology or internal settings, though it does not grant modification or code execution capabilities.

The affected product is runZero Platform. Versions prior to v4.0.260416.0 are vulnerable; the issue was resolved in that release.

The feature is not included in CISA KEV and no EPSS score is currently available. The CVSS score indicates a medium severity. The attack vector appears to be network-based, likely involving an authenticated request to an endpoint that unintentionally exposes configuration data. The threat is primarily to confidentiality for the organization’s internal data and is only exploitable if the attacker can reach the relevant endpoints.