CyberRota Analysis
AI-GeneratedThe hunt_delete() VQL function in Velociraptor improperly implements permission checks, allowing users with the COLLECT_CLIENT role to delete hunts without the necessary DELETE_RESULTS permission typically reserved for administrators. This vulnerability could lead to unauthorized deletion of critical hunt data, potentially disrupting investigations and data integrity. Organizations using Velociraptor should prioritize addressing this issue to safeguard sensitive information and maintain proper access controls.
Original NVD Description
The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").