EUVD-2026-27844
GHSA-2v93-vp82-cjv8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.
However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
AnalysisAI
Velociraptor versions prior to 0.76.4 allow authenticated users with reader role in the root organization to bypass cross-organization authorization controls via HTTP API GET requests, enabling them to read arbitrary files from other organizations regardless of their permissions in those target organizations. The vulnerability requires high privilege context (authenticated reader in root org) but has high confidentiality impact across organization boundaries. This is a horizontal privilege escalation affecting multi-tenant deployments where organizational isolation is a critical security boundary.
Technical ContextAI
Velociraptor is a digital forensics and incident response platform that supports multi-organization deployments with role-based access control. The vulnerability exists in the HTTP API authorization layer, specifically in how GET request handlers validate cross-organization access permissions. The root cause is improper access control checks (CWE-863: Incorrect Authorization) that fail to enforce organization boundaries for authenticated users. The flaw allows a reader-role user in the root organization to construct authenticated API requests that bypass authorization validation for resources belonging to subordinate organizations, despite the CVSS vector indicating PR:H (high privilege required), the actual impact is that the lowest authenticated role in the privileged root organization can access resources beyond its intended scope.
RemediationAI
Upgrade Velociraptor to version 0.76.4 or later to receive the vendor-released patch that corrects the cross-organization authorization bypass. For organizations unable to immediately upgrade, implement network-level mitigations by restricting HTTP API access to the Velociraptor server to trusted administrative networks only, and audit IAM assignments to ensure reader role in root organization is granted only to users with legitimate need for multi-organization access. Additionally, enable and monitor HTTP API audit logs to detect anomalous cross-organization access patterns from root organization reader accounts. Note that these compensating controls do not fully mitigate the vulnerability - they reduce exploitability surface by limiting authentication opportunities and detect-only suspicious activity - so patching remains the primary remediation path.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user t
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today