PT-2026-37643 · Unknown · Velociraptor

Faisal Alhumaid · Published 2026-05-06 · Updated 2026-05-20 · CVE-2026-6863

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.76.4

Description A cross organization authorization bypass exists in the HTTP API. A user assigned the reader role in the root organization, which possesses only READ RESULTS permission, can perform an authenticated HTTP GET request to read files from other organizations, regardless of whether they have explicit permissions in the target organization.

Recommendations Update to version 0.76.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-6863

GHSA-2V93-VP82-CJV8

GO-2026-4997

Affected Products

Velociraptor

References · 9

• https://osv.dev/vulnerability/GO-2026-4997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6863 · Security Note
• https://osv.dev/vulnerability/GHSA-2v93-vp82-cjv8 · Vendor Advisory
• https://github.com/Velocidex/velociraptor · Note
• https://docs.velociraptor.app/announcements/advisories/cve-2026-6863 · Note
• https://t.me/CVEtracker/52864 · Telegram Post
• https://github.com/advisories/GHSA-2v93-vp82-cjv8 · Note
• https://twitter.com/CVEnew/status/2052086730095054881 · Twitter Post
• https://twitter.com/infoflowcloud/status/2052087593504821627 · Twitter Post