This vulnerability in the runZero Platform allowed users with all-organization administrator privileges to escalate other accounts to superuser status, representing improper privilege management (CWE-269). The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity but no impact on availability. The issue was fixed in version 4.0.260202.0. No patch links or vendor advisory details were provided, and the platform is not cloud-hosted, so remediation depends on upgrading to the fixed version.

Successful exploitation could allow an all-organization administrator to promote accounts to superuser status, resulting in full compromise of confidentiality and integrity within the runZero Platform. This could lead to unauthorized access and control over sensitive data and system functions. Availability is not impacted. No known exploits in the wild have been reported.

Upgrade the runZero Platform to version 4.0.260202.0 or later, where this privilege escalation vulnerability has been fixed. Since the platform is not cloud-hosted and no official remediation level is provided, applying the vendor's fixed version is the recommended action. Monitor vendor advisories for any further updates.