EUVD-2026-56183
GHSA-jm4c-88wp-rfjq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
PR:H reflects required child org admin credentials; S:C captures cross-org deletion impact; C:N because deletion does not expose confidential data.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Velociraptor allows multi-tenant deployments named "Orgs".
By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment.
Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org.
This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
AnalysisAI
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold active administrator-level access to any child org within a multi-tenant Velociraptor deployment - this is a high-privilege position, not an unauthenticated or low-privilege starting point. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.7 score with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H is well-calibrated: PR:H correctly captures that a child org admin credential is required, while S:C reflects the cross-tenancy blast radius where a single compromised admin can destroy orgs outside their own boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A child org administrator, who holds no elevated privileges in the ROOT org, navigates to their org's ACL management and adds the ORG_ADMIN permission to their own token. They then send an authenticated org-deletion API request targeting a peer child org; the Velociraptor server evaluates ORG_ADMIN in the caller's child org context, finds it present, and authorizes the deletion. … |
| Remediation | Apply the upstream fix available in GitHub commit dc38bd6a7e12a678cd79e726bdd1ded4eed75967 (https://github.com/Velocidex/velociraptor/commit/dc38bd6a7e12a678cd79e726bdd1ded4eed75967); a specific patched release version number is not independently confirmed from the provided data, so operators should consult the vendor advisory at https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/ for the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and audit all accounts with child organization administrator privileges, review server logs for organization deletion attempts or deletions since deployment, and immediately implement restrictions on root-level ACL modifications by child org admins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write fi
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today