Vulnerability in Velociraptor Plugin Allows Unauthorized Access to Multiple Organizations

CVE-2026-6290

What is CVE-2026-6290?

Velociraptor versions before 0.76.3 exhibit a significant security issue within the query() plugin. This vulnerability allows authenticated users with access to one organization to execute VQL queries on other organizations without proper authorization. By leveraging the user's current ACL token, a user can potentially view and manipulate data in organizations where their permissions should not apply, leading to unauthorized access to sensitive information.

References