CVE-2026-18652

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a user with read access to the root org can access result sets from child orgs.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-18652/

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Velociraptor permite la lectura de conjuntos de resultados apilados desde la GUI. El diseño multi-inquilino de Velociraptor almacena sub-organizaciones dentro del directorio de almacenamiento de datos. La ruta solicitada por la GUI no se verifica correctamente contra la lista de denegación de prefijos, permitiendo que los conjuntos de resultados lean desde prefijos denegados. En particular, un usuario con acceso de lectura a la organización raíz puede acceder a conjuntos de resultados de organizaciones hijas.

Information

Published : 2026-08-12 10:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-18652

Mitre link : CVE-2026-18652

CVE.ORG link : CVE-2026-18652

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-18652", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18652", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T12:28:05.520917Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T10:17:16.940", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18652/", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Velociraptor allows reading Stacked result sets from the GUI.\u00a0 Velociraptor's multi-tenant design stores sub orgs within the datastore directory.\u00a0The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes.\n\nIn particular, a user with read access to the root org can access result sets from child orgs."}, {"lang": "es", "value": "Velociraptor permite la lectura de conjuntos de resultados apilados desde la GUI. El dise\u00f1o multi-inquilino de Velociraptor almacena sub-organizaciones dentro del directorio de almacenamiento de datos. La ruta solicitada por la GUI no se verifica correctamente contra la lista de denegaci\u00f3n de prefijos, permitiendo que los conjuntos de resultados lean desde prefijos denegados.\n\nEn particular, un usuario con acceso de lectura a la organizaci\u00f3n ra\u00edz puede acceder a conjuntos de resultados de organizaciones hijas."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "cve@rapid7.com"}