Velociraptor CVE-2026-6863

The vulnerability requires the attacker to possess an authenticated user account with reader role (or higher) in the root organization of a multi-organization Velociraptor deployment. The vulnerability does not occur in reverse - users with read access only to subordinate organizations cannot escalate to access other organizations or the root organization. Exploitation is limited to HTTP GET requests against API endpoints that handle cross-organization file or data retrieval. Single-organization Velociraptor deployments are not affected since the bypass specifically exploits the cross-organization authorization boundary. The attack requires network-level access to the Velociraptor HTTP API endpoint and valid authentication credentials for a root organization user account.

The CVSS score of 6.8 reflects a Medium-to-High severity profile with network vector (AV:N), low complexity (AC:L), and high privilege requirement (PR:H), resulting in high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). The PR:H qualifier significantly limits real-world exploitation scope - the attacker must already hold reader role in the root organization, which is an administratively-granted role in multi-tenant Velociraptor deployments. However, the scope change (S:C) indicates the vulnerability crosses trust boundaries (organization isolation), which is a critical security property in forensics platforms handling sensitive incident data. Risk materialization depends on: (1) deployment model (multi-organization vs. single-org), (2) whether reader role in root org is broadly delegated, and (3) sensitivity of data in subordinate organizations. In typical multi-tenant forensics scenarios, root organization access is tightly controlled, limiting this to insider threats or compromised high-privilege accounts. The unidirectional nature (subordinate org users cannot access root org) further reduces blast radius. No exploitation data (KEV status, POC, active exploitation claims) is provided, so real-world prevalence is unknown.

An authenticated user holding reader role in Velociraptor's root organization constructs an authenticated HTTP GET request targeting a file-read API endpoint with a resource path pointing to a subordinate organization's sensitive forensics data (e.g., /api/v1/GetTable?org_id=sub_org_name&artifact=System.Processes). The authorization validation layer fails to properly enforce organization boundaries and returns the requested data despite the user lacking any explicit permissions in the target organization. The attacker gains unauthorized access to incident response artifacts, collected logs, or forensic evidence from investigation teams in other organizations.