CVE-2026-6863

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Velociraptor anteriores a la 0.76.4 contienen una omisión de autorización entre organizaciones en la API HTTP. Un usuario con solo el rol de lector en la organización raíz (el rol autenticado más bajo, que posee solo el permiso READ_RESULTS) puede emitir una única solicitud HTTP GET autenticada que puede leer cualquier archivo de otras organizaciones, incluso si no tienen permisos explícitos en la organización de destino. Sin embargo, el problema no ocurre a la inversa: un usuario con acceso de lectura a una suborganización no puede leer de otras organizaciones o de la organización raíz.

Information

Published : 2026-05-06 16:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-6863

Mitre link : CVE-2026-6863

CVE.ORG link : CVE-2026-6863

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-6863", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6863", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T15:26:49.596766Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.76.4, 0.75.9", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-05-06T16:16:12.030", "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org."}, {"lang": "es", "value": "Las versiones de Velociraptor anteriores a la 0.76.4 contienen una omisi\u00f3n de autorizaci\u00f3n entre organizaciones en la API HTTP. Un usuario con solo el rol de lector en la organizaci\u00f3n ra\u00edz (el rol autenticado m\u00e1s bajo, que posee solo el permiso READ_RESULTS) puede emitir una \u00fanica solicitud HTTP GET autenticada que puede leer cualquier archivo de otras organizaciones, incluso si no tienen permisos expl\u00edcitos en la organizaci\u00f3n de destino.\n\nSin embargo, el problema no ocurre a la inversa: un usuario con acceso de lectura a una suborganizaci\u00f3n no puede leer de otras organizaciones o de la organizaci\u00f3n ra\u00edz."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "cve@rapid7.com"}