Cross Organization Authorization Bypass in Velociraptor by Velociraptor

CVE-2026-6863

What is CVE-2026-6863?

Velociraptor prior to version 0.76.4 is affected by a vulnerability that allows users with the reader role in the root organization to conduct unauthorized access. Specifically, these users can perform an authenticated HTTP GET request, enabling them to read files from other organizations, despite lacking explicit permissions. This issue poses risks as it allows leakage of sensitive information between organizations, although the vulnerability does not extend in reverse; users with read access to a sub-organization cannot access the root organization or other organizations.

References