Medium severity6.8NVD Advisory· Published May 6, 2026· Updated Jun 17, 2026
CVE-2026-6863
CVE-2026-6863
Description
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.
However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
www.velocidex.com/golang/velociraptorGo | < 0.76.4 | 0.76.4 |
Affected products
2- ghsa-coords2 versionspkg:golang/www.velocidex.com/golang/velociraptorpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.76.4+ 1 more
- (no CPE)range: < 0.76.4
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.