What’s Vulnerable › Vulnerabilities
CVE-2026-6863: HTTP Filestore Endpoints Misapply Permissions Across Organizations
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-06 · updated 2026-10-26
- Weakness: CWE-863
Description
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
Affected products
- Rapid7 Velociraptor: before 0.76.4, 0.75.9 — fixed in 0.75.9, 0.76.4
How to fix
Upgrade to a fixed version: Rapid7 Velociraptor 0.75.9, 0.76.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6863 or the next vulnerability affects your stack