{"id":"EUVD-2026-27844","revision":"f63f159217f24f4db14fca18d9a349d3","records":[{"revision":"f63f159217f24f4db14fca18d9a349d3","observedAt":"2026-11-07T14:20:56.059+00:00","statement":{"source":"euvd","id":"EUVD-2026-27844","aliases":["CVE-2026-6863"],"title":"Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can is…","description":"Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","score":6.8,"severity":null}],"references":["https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27844","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 6, 2026, 2:50:55 PM","dateUpdated":"May 6, 2026, 3:27:40 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","vulnerabilityIds":["CVE-2025-0914","CVE-2026-12143","CVE-2026-14257","CVE-2026-17535","CVE-2026-18348","CVE-2026-18636","CVE-2026-18638","CVE-2026-18639","CVE-2026-18860","CVE-2026-27601","CVE-2026-29074","CVE-2026-41650","CVE-2026-45623","CVE-2026-49356","CVE-2026-5329","CVE-2026-53550","CVE-2026-55602","CVE-2026-56852","CVE-2026-59869","CVE-2026-6290","CVE-2026-64951","CVE-2026-64952","CVE-2026-64954","CVE-2026-65903","CVE-2026-65912","CVE-2026-65913","CVE-2026-65914","CVE-2026-67314","CVE-2026-67320","CVE-2026-6863","CVE-2026-69152","CVE-2026-69153","CVE-2026-6948","CVE-2026-73086","CVE-2026-73646","CVE-2026-73650","CVE-2026-7572","CVE-2026-7573","CVE-2026-84369","CVE-2026-84370"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-27844","identifiers":["EUVD-2026-27844","CVE-2026-6863"]},"retained":false,"historicalAffected":[]}],"coverage":[]}