# CVE-2026-6863: Velocidex Velociraptor authorization bypass in HTTP API

Source: https://junglewise.ai/threats/cve-2026-6863-velocidex-velociraptor-authorization-bypass-in-http-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-6863 · Severity: medium · CVSS 6.8 · Published 2026-05-06

Velociraptor is an open-source digital forensics and incident response platform used to monitor and investigate security events across an enterprise. A security flaw allows a user with basic 'reader' access in the main organization to bypass security boundaries and view files belonging to other sub-organizations. This could lead to the unauthorized exposure of sensitive investigation data or system files across different business units or clients.

Technologies: [www.velocidex.com/golang/velociraptor (Go)](https://junglewise.ai/threats/technologies/www-velocidex-com-golang-velociraptor), [Velocidex Velociraptor](https://junglewise.ai/threats/technologies/velociraptor). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Velocidex](https://junglewise.ai/threats/vendors/velocidex).

## Quick answers

**Is CVE-2026-6863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6863 being exploited in the wild.

**How severe is CVE-2026-6863?** Medium severity, with a CVSS score of 6.8, published 6 May 2026.

**Which products and versions are affected?** www.velocidex.com/golang/velociraptor (Go) < 0.76.4, SEMVER:introduced=0,fixed=0.76.4; Velocidex Velociraptor < 0.76.4, < 0.75.9.

**Is there a fix for CVE-2026-6863?** Yes. www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6863 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6863?** Check whether you run www.velocidex.com/golang/velociraptor (Go) or Velocidex Velociraptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.4 or later

  ```sh
  go get www.velocidex.com/golang/velociraptor@v0.76.4
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the Velociraptor HTTP API filestore endpoints. The root cause is a failure to properly enforce organizational boundaries when processing authenticated HTTP GET requests. An attacker with the 'reader' role (READ_RESULTS permission) in the root organization can craft requests to access files in any other sub-organization, even without explicit permissions in those targets. This bypass is unidirectional; users in sub-organizations cannot access the root or other sub-organizations. The issue is resolved in versions 0.76.4 and 0.75.9.

## Affected products

- Velocidex Velociraptor < 0.76.4, < 0.75.9

## Identifiers

- CVE-2026-6863
- GHSA-2v93-vp82-cjv8
- GO-2026-4997

## Timeline

- 2026-04-19: disclosed: Initial report by Faisal Alhumaid
- 2026-04-28: patched: Advisory published and patch distributed
- 2026-05-06: advisory: Published to GitHub Advisory Database and NVD

## References

- [https://docs.velociraptor.app/announcements/advisories/cve-2026-6863](https://docs.velociraptor.app/announcements/advisories/cve-2026-6863)

## Related threats

- [Velociraptor SQL plugin missing authorization checks](https://junglewise.ai/threats/cve-2026-85737-velociraptor-is-a-tool-for-collecting-host-based-state)
- [Velociraptor privilege escalation in Windows.Sysinternals.SysmonLogForward artifact](https://junglewise.ai/threats/cve-2026-78413-velociraptor-allows-collection-of-vql-queries-packaged-into)
- [Velociraptor deadlock condition in user management module](https://junglewise.ai/threats/cve-2026-77798-velociraptor-contains-a-deadlock-condition-that-may-be-triggered)
- [Velociraptor VQL injection in notebook backup restore](https://junglewise.ai/threats/cve-2026-19584-velociraptor-vql-injection-in-notebook-backup-restore)
- [Velociraptor permission bypass via client monitoring artifacts](https://junglewise.ai/threats/cve-2026-19583-velociraptor-permission-bypass-via-client-monitoring-artifacts)