What’s Vulnerable › Vulnerabilities
CVE-2026-7573: GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
- Severity: high (CVSS 7.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-06 · updated 2026-07-24
- Weakness: CWE-639
Description
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.
Affected products
- Rapid7 Velociraptor: before 0.76.5 — fixed in 0.76.5
How to fix
Upgrade to a fixed version: Rapid7 Velociraptor 0.76.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-7573 or the next vulnerability affects your stack