Elevated Permission Vulnerability in Velociraptor Software

CVE-2025-6264

What is CVE-2025-6264?

Velociraptor, a powerful endpoint monitoring tool, contains a serious flaw that permits users with limited permissions to execute potentially harmful commands. Specifically, the artifact responsible for updating client configuration, Admin.Client.UpdateClientConfig, does not enforce necessary permission checks. This oversight allows users granted COLLECT_CLIENT permissions, often assigned to those in the Investigator role, to execute arbitrary commands and potentially take control of affected endpoints. To mitigate this risk, it is essential for users and administrators to ensure that only authorized personnel can collect and manage these artifacts, thereby safeguarding sensitive operations within their environment.

References