CVE-2026-6863

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6863", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2026-04-22T14:25:24.122Z", "datePublished": "2026-05-06T14:50:55.631Z", "dateUpdated": "2026-05-06T15:27:40.088Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-05-06T14:54:19.814Z"}, "title": "HTTP Filestore Endpoints Misapply Permissions Across Organizations", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Improper Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "affected": [{"vendor": "Rapid7", "product": "Velociraptor", "platforms": ["Linux"], "repo": "https://github.com/Velocidex/velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.76.4, 0.75.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.</p><p>However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.</p>"}]}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "To remediate, you will need to\u00a0 upgrade your server https://docs.velociraptor.app/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade \u00a0to the latest version of your release:\n\n * For 0.76 releases, upgrade immediately to\u00a0 v0.76.4 https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64 \n * For 0.75 releases, upgrade immediately to\u00a0 v0.75.9 https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>To remediate, you will need to&nbsp;<a href=\"https://docs.velociraptor.app/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade\">upgrade your server</a>&nbsp;to the latest version of your release:</p><ul><li>For 0.76 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64\" target=\"_blank\">v0.76.4</a></li><li>For 0.75 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64\" target=\"_blank\">v0.75.9</a></li></ul>"}]}], "credits": [{"lang": "en", "value": "We thank Faisal Alhumaid (Faisal.alhumaid@hotmail.com) for reporting this issue responsibly.", "type": "finder"}], "source": {"advisory": "docs.velociraptor.app/announcements/advisories/cve-2026-6863/", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T15:26:49.596766Z", "id": "CVE-2026-6863", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T15:27:40.088Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T15:26:49.596766Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T15:27:36.566Z"}}], "cna": {"title": "HTTP Filestore Endpoints Misapply Permissions Across Organizations", "source": {"advisory": "docs.velociraptor.app/announcements/advisories/cve-2026-6863/", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "We thank Faisal Alhumaid (Faisal.alhumaid@hotmail.com) for reporting this issue responsibly."}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.76.4, 0.75.9", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "To remediate, you will need to\u00a0 upgrade your server https://docs.velociraptor.app/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade \u00a0to the latest version of your release:\n\n * For 0.76 releases, upgrade immediately to\u00a0 v0.76.4 https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64 \n * For 0.75 releases, upgrade immediately to\u00a0 v0.75.9 https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64", "supportingMedia": [{"type": "text/html", "value": "<p>To remediate, you will need to&nbsp;<a href=\"https://docs.velociraptor.app/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade\">upgrade your server</a>&nbsp;to the latest version of your release:</p><ul><li>For 0.76 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64\" target=\"_blank\">v0.76.4</a></li><li>For 0.75 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64\" target=\"_blank\">v0.75.9</a></li></ul>", "base64": false}]}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.", "supportingMedia": [{"type": "text/html", "value": "<p>Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.</p><p>However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Improper Authorization"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-05-06T14:54:19.814Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6863", "state": "PUBLISHED", "dateUpdated": "2026-05-06T15:27:40.088Z", "dateReserved": "2026-04-22T14:25:24.122Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2026-05-06T14:50:55.631Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Velociraptor", "repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "versions": [{"lessThan": "0.76.4, 0.75.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@rapid7.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org."}, {"lang": "es", "value": "Las versiones de Velociraptor anteriores a la 0.76.4 contienen una omisi\u00f3n de autorizaci\u00f3n entre organizaciones en la API HTTP. Un usuario con solo el rol de lector en la organizaci\u00f3n ra\u00edz (el rol autenticado m\u00e1s bajo, que posee solo el permiso READ_RESULTS) puede emitir una \u00fanica solicitud HTTP GET autenticada que puede leer cualquier archivo de otras organizaciones, incluso si no tienen permisos expl\u00edcitos en la organizaci\u00f3n de destino.\n\nSin embargo, el problema no ocurre a la inversa: un usuario con acceso de lectura a una suborganizaci\u00f3n no puede leer de otras organizaciones o de la organizaci\u00f3n ra\u00edz."}], "id": "CVE-2026-6863", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "cve@rapid7.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6863", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T15:26:49.596766Z", "version": "2.0.3"}}]}, "published": "2026-05-06T16:16:12.030", "references": [{"source": "cve@rapid7.com", "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.76.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Velociraptor", "source": "cna", "vendor": "Rapid7"}, "product": "velociraptor", "vendor": "rapid7"}], "created": "2026-05-06T16:30:06.711247+00:00", "updated": "2026-05-06T23:00:14.939957+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$velociraptor"]}