PT-2026-37339 · Velocidex · Velociraptor

Michaelddickenson · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-7573

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Velocidex Velociraptor versions prior to 0.76.5

Description An authorization bypass in the 'GetUserRoles' gRPC API endpoint allows any authenticated low-privilege user to retrieve the complete Access Control List (ACL) policy, including roles and permissions, for any user across all organizations. This is achieved by supplying targeted Name and Org parameters via a network request.

Recommendations Update to version 0.76.5 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-7573

Affected Products

Velociraptor

References · 4

• https://docs.velociraptor.app/announcements/advisories/cve-2026-7573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7573 · Security Note
• https://t.me/cveNotify/162283 · Telegram Post
• https://t.me/CVEtracker/52813 · Telegram Post