{"id":"EUVD-2026-27844","enisaUuid":"cd4d979a-66cc-34a1-b6b8-fedadb37fe4e","description":"Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.","datePublished":"May 6, 2026, 2:50:55 PM","dateUpdated":"May 6, 2026, 3:27:40 PM","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","references":"https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/\n","aliases":"CVE-2026-6863\n","assigner":"rapid7","epss":0.24,"enisaIdProduct":[{"id":"bec6a9f0-b79f-30a2-b3dc-ece5d5e60dc6","product":{"name":"Velociraptor","vendor":{"name":"Rapid7"}},"product_version":"0 \u003c0.76.4, 0.75.9"}],"enisaIdVendor":[{"id":"8edc4ac3-864e-3cec-af6d-93bfd300378d","vendor":{"name":"Rapid7"}}],"enisaIdVulnerability":[{"id":"3bce19be-ebca-32d5-a0cb-a4a795fd85d6","vulnerability":{"id":"CVE-2026-6863","description":"Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.","datePublished":"May 6, 2026, 2:50:55 PM","dateUpdated":"May 6, 2026, 3:27:40 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","references":"https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/\n","enisa_id":"EUVD-2026-27844\n","assigner":"rapid7","epss":0.24,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"9cb9d6f5-975b-3384-bee6-821d821d5241","product":{"name":"Velociraptor","vendor":{"name":"Rapid7"}},"product_version":"0 \u003c0.76.4, 0.75.9"}],"vulnerabilityVendor":[{"id":"38154cae-2155-3f89-b6ec-76f3fa15c83d","vendor":{"name":"Rapid7"}}]}},{"id":"445b35ad-e7b6-33cf-b2ba-f08d67bfe788","vulnerability":{"id":"GHSA-2v93-vp82-cjv8","description":"Velocidex Velociraptor has an Incorrect Authorization issue","datePublished":"May 6, 2026, 6:30:30 PM","dateUpdated":"May 11, 2026, 2:58:15 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-6863\nhttps://docs.velociraptor.app/announcements/advisories/cve-2026-6863\nhttps://github.com/Velocidex/velociraptor\n","enisa_id":"EUVD-2026-27844\n","aliases":"CVE-2026-6863\nGHSA-2v93-vp82-cjv8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"1ae4a24f-b32e-36e7-a374-84175972ea96","advisory":{"id":"openSUSE-SU-2026:12070-1","description":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","summary":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","datePublished":"Oct 6, 2026, 12:00:00 AM","dateUpdated":"Oct 7, 2026, 8:42:32 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12070-1.json\nhttps://www.suse.com/security/cve/CVE-2025-0914/\nhttps://www.suse.com/security/cve/CVE-2026-12143/\nhttps://www.suse.com/security/cve/CVE-2026-14257/\nhttps://www.suse.com/security/cve/CVE-2026-17535/\nhttps://www.suse.com/security/cve/CVE-2026-18348/\nhttps://www.suse.com/security/cve/CVE-2026-18636/\nhttps://www.suse.com/security/cve/CVE-2026-18638/\nhttps://www.suse.com/security/cve/CVE-2026-18639/\nhttps://www.suse.com/security/cve/CVE-2026-18860/\nhttps://www.suse.com/security/cve/CVE-2026-27601/\nhttps://www.suse.com/security/cve/CVE-2026-29074/\nhttps://www.suse.com/security/cve/CVE-2026-41650/\nhttps://www.suse.com/security/cve/CVE-2026-45623/\nhttps://www.suse.com/security/cve/CVE-2026-49356/\nhttps://www.suse.com/security/cve/CVE-2026-5329/\nhttps://www.suse.com/security/cve/CVE-2026-53550/\nhttps://www.suse.com/security/cve/CVE-2026-55602/\nhttps://www.suse.com/security/cve/CVE-2026-56852/\nhttps://www.suse.com/security/cve/CVE-2026-59869/\nhttps://www.suse.com/security/cve/CVE-2026-6290/\nhttps://www.suse.com/security/cve/CVE-2026-64951/\nhttps://www.suse.com/security/cve/CVE-2026-64952/\nhttps://www.suse.com/security/cve/CVE-2026-64954/\nhttps://www.suse.com/security/cve/CVE-2026-65903/\nhttps://www.suse.com/security/cve/CVE-2026-65912/\nhttps://www.suse.com/security/cve/CVE-2026-65913/\nhttps://www.suse.com/security/cve/CVE-2026-65914/\nhttps://www.suse.com/security/cve/CVE-2026-67314/\nhttps://www.suse.com/security/cve/CVE-2026-67320/\nhttps://www.suse.com/security/cve/CVE-2026-6863/\nhttps://www.suse.com/security/cve/CVE-2026-69152/\nhttps://www.suse.com/security/cve/CVE-2026-69153/\nhttps://www.suse.com/security/cve/CVE-2026-6948/\nhttps://www.suse.com/security/cve/CVE-2026-73086/\nhttps://www.suse.com/security/cve/CVE-2026-73646/\nhttps://www.suse.com/security/cve/CVE-2026-73650/\nhttps://www.suse.com/security/cve/CVE-2026-7572/\nhttps://www.suse.com/security/cve/CVE-2026-7573/\nhttps://www.suse.com/security/cve/CVE-2026-84369/\nhttps://www.suse.com/security/cve/CVE-2026-84370/\n","aliases":"CVE-2025-0914\nCVE-2026-12143\nCVE-2026-14257\nCVE-2026-17535\nCVE-2026-18348\nCVE-2026-18636\nCVE-2026-18638\nCVE-2026-18639\nCVE-2026-18860\nCVE-2026-27601\nCVE-2026-29074\nCVE-2026-41650\nCVE-2026-45623\nCVE-2026-49356\nCVE-2026-5329\nCVE-2026-53550\nCVE-2026-55602\nCVE-2026-56852\nCVE-2026-59869\nCVE-2026-6290\nCVE-2026-64951\nCVE-2026-64952\nCVE-2026-64954\nCVE-2026-65903\nCVE-2026-65912\nCVE-2026-65913\nCVE-2026-65914\nCVE-2026-67314\nCVE-2026-67320\nCVE-2026-6863\nCVE-2026-69152\nCVE-2026-69153\nCVE-2026-6948\nCVE-2026-73086\nCVE-2026-73646\nCVE-2026-73650\nCVE-2026-7572\nCVE-2026-7573\nCVE-2026-84369\nCVE-2026-84370\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05b56faf-e40a-3609-857d-fad5e693db42","product":{"name":"velociraptor-0:0.76.7.0.git145.b60ef1146-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"23f64df1-d714-3f37-856e-9686bd2d5a8e","product":{"name":"velociraptor-0:0.76.7.0.git145.b60ef1146-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"46c42df9-32cf-34c3-9ad7-37605a504cb5","product":{"name":"velociraptor-0:0.76.7.0.git145.b60ef1146-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"75a0b099-9e17-3479-94ab-60ab3dc7c2b4","product":{"name":"velociraptor-0:0.76.7.0.git145.b60ef1146-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d49e1171-6896-36ad-90d8-9020a283a429","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}}]}}]}