SEPTEMBER 23, 2026
Live Feed
Back to database
Case File

CVE-2026-6863

MEDIUM · CVSS 6.8 EPSS 0.24%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-05-06 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 6.8. See the original NVD description below for full technical details.

CVE
CVE-2026-6863
Severity
MEDIUM
CVSS
6.8
EPSS
0.24%

Original NVD Description

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.