Medium severity6.8NVD Advisory· Published May 6, 2026· Updated May 7, 2026
CVE-2026-6863
CVE-2026-6863
Description
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.
However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
www.velocidex.com/golang/velociraptorGo | < 0.76.4 | 0.76.4 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.