CVE-2026-6863

{
  "id": "CVE-2026-6863",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-06T16:16:12.030",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org."
    },
    {
      "lang": "es",
      "value": "Las versiones de Velociraptor anteriores a la 0.76.4 contienen una omisión de autorización entre organizaciones en la API HTTP. Un usuario con solo el rol de lector en la organización raíz (el rol autenticado más bajo, que posee solo el permiso READ_RESULTS) puede emitir una única solicitud HTTP GET autenticada que puede leer cualquier archivo de otras organizaciones, incluso si no tienen permisos explícitos en la organización de destino.\n\nSin embargo, el problema no ocurre a la inversa: un usuario con acceso de lectura a una suborganización no puede leer de otras organizaciones o de la organización raíz."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Velociraptor",
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "repo": "https://github.com/Velocidex/velociraptor",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.76.4, 0.75.9",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T15:26:49.596766Z",
          "id": "CVE-2026-6863",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/",
      "source": "[email protected]"
    }
  ]
}