CVE-2026-6863CWE-863

HTTP Filestore Endpoints Misapply Permissions Across Organizations

Medium · published May 6, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.

However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-06T14:50Z
EPSS history
Timeline
  • 06 MAY 14:50Z
    HTTP Filestore Endpoints Misapply Permissions Across Organizations
    cvelistv5