CVE-2026-7573CWE-639

GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

Medium · published May 6, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-06T02:15Z
EPSS history
Timeline
  • 06 MAY 02:15Z
    GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
    cvelistv5