CVE-2026-18860

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/
https://github.com/Velocidex/velociraptor/commit/dc38bd6a7e12a678cd79e726bdd1ded4eed75967

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-11 15:17

Updated : 2026-08-28 21:17

NVD link : CVE-2026-18860

Mitre link : CVE-2026-18860

CVE.ORG link : CVE-2026-18860

JSON object : View

Products Affected

No product.

CWE

CWE-280

Improper Handling of Insufficient Permissions or Privileges

{"id": "CVE-2026-18860", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18860", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T19:25:41.955281Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "Velociraptor", "collectionURL": "https://github.com/Velocidex/velociraptor/releases", "defaultStatus": "unaffected"}]}], "published": "2026-08-11T15:17:28.887", "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/", "source": "cve@rapid7.com"}, {"url": "https://github.com/Velocidex/velociraptor/commit/dc38bd6a7e12a678cd79e726bdd1ded4eed75967", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-280"}]}], "descriptions": [{"lang": "en", "value": "Velociraptor allows multi-tenant deployments named \"Orgs\".\n\nBy default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment.\n\nUsers can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org.\n\nThis issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org.\u00a0This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs."}], "lastModified": "2026-08-28T21:17:10.720", "sourceIdentifier": "cve@rapid7.com"}