EUVD-2026-27517
GHSA-3c93-g9g6-p5j4
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable gRPC endpoint, low complexity, requires an authenticated low-priv account (PR:L); crossing the org boundary changes scope (S:C) with confidentiality-only ACL disclosure (C:H, I/A:N).
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
6DescriptionNVD
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.
AnalysisAI
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to enumerate the full role and permission policy of any user in any organization by abusing the GetUserRoles gRPC endpoint with attacker-chosen Name and Org parameters. The scope-changing flaw (CVSS 3.1 7.7, S:C) breaches tenant isolation in a DFIR platform where multi-org separation is a core trust boundary. No public exploit identified at time of analysis, and EPSS is very low (0.01%), so this is a confidentiality/reconnaissance issue rather than a code-execution or actively-exploited threat.
Technical ContextAI
Velociraptor is an open-source endpoint monitoring, digital forensics and incident response (DFIR) platform whose server exposes a gRPC API for administrative and client operations, including multi-tenant 'org' separation so different teams or customers can share one deployment. The GetUserRoles endpoint returns the ACL policy (assigned roles and their effective permissions) for a named user within a named org. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the endpoint trusts the caller-supplied Name and Org identifiers to select which record to return without verifying that the caller is authorized to read ACLs for that target user or that org, so an object reference the attacker controls becomes a cross-tenant read primitive. The single affected product per CPE is cpe:2.3:a:velocidex:velociraptor across all versions below the fix.
RemediationAI
Vendor-released patch: upgrade to Velociraptor 0.76.5 or later, which is the primary and complete fix, per the vendor advisory at https://docs.velociraptor.app/announcements/advisories/cve-2026-7573/. Until upgrading, reduce exposure by tightening who holds authenticated accounts: minimize the number of low-privilege users on shared multi-org servers and review org membership, since any authenticated user can trigger the endpoint (trade-off: does not close the bug, only shrinks the pool of potential abusers). Where feasible, restrict network access to the gRPC API to trusted administrative hosts/VPN and monitor API logs for GetUserRoles calls that reference orgs or usernames the caller has no legitimate relationship to (trade-off: detection/containment only, and network restrictions may hamper legitimate distributed collection). Because impact is confined to ACL confidentiality, no destructive workaround is warranted; prioritize the upgrade over compensating controls. Do not rely on version numbers other than 0.76.5.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write fi
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today