Executive brief
Velociraptor is an open-source digital forensics and incident response platform used to monitor and investigate security events across an enterprise. A security flaw allows a user with basic 'reader' access in the main organization to bypass security boundaries and view files belonging to other sub-organizations. This could lead to the unauthorized exposure of sensitive investigation data or system files across different business units or clients.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Velociraptor HTTP API filestore endpoints. The root cause is a failure to properly enforce organizational boundaries when processing authenticated HTTP GET requests. An attacker with the 'reader' role (READ_RESULTS permission) in the root organization can craft requests to access files in any other sub-organization, even without explicit permissions in those targets. This bypass is unidirectional; users in sub-organizations cannot access the root or other sub-organizations. The issue is resolved in versions 0.76.4 and 0.75.9.
Affected products
- Velocidex Velociraptor < 0.76.4, < 0.75.9
Timeline
- 2026-04-19: disclosed: Initial report by Faisal Alhumaid
- 2026-04-28: patched: Advisory published and patch distributed
- 2026-05-06: advisory: Published to GitHub Advisory Database and NVD