CVE-2026-6863
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedVelociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceVelociraptor versions before 0.76.4 have a cross-organization authorization bypass in the HTTP API where a user with only the reader role (READ_RESULTS permission) in the root organization can read files from other organizations despite having no permissions in those target organizations. The flaw allows unauthenticated cross-org data access in one direction only - from root org to sub-orgs.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Velociraptor versionRun `velociraptor --version` or query the server status via the HTTP API to retrieve the running version numberAffected if The installed version is earlier than 0.76.4 (e.g., 0.76.3, 0.76.2, etc.)
-
Verify multiple organizations existQuery the Velociraptor configuration or API for configured organizations. Look for more than one organization in the deployment, including at least one sub-organization under the root orgAffected if There are multiple organizations configured, with sub-organizations existing beneath the root organization
-
Confirm HTTP API is accessibleCheck if the Velociraptor HTTP API endpoint (typically port 8000 or 443) is exposed and accepting requests. Verify the API responds to authenticated requestsAffected if The HTTP API is enabled and accessible, allowing authenticated users to make API calls
-
Identify reader role users in root orgReview user accounts in the root organization and identify any users assigned only the reader role (READ_RESULTS permission) who have no explicit permissions in other organizationsAffected if A user exists with reader role in the root organization who has no permissions assigned in any sub-organization
You are affected if Velociraptor version is before 0.76.4 AND multiple organizations exist AND the HTTP API is accessible AND a reader-role user in the root org can potentially access sub-org data.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to Velociraptor 0.76.4 or later to patch the authorization logic, or implement network-level access controls to restrict HTTP API access between organizations until upgrade is possible.
0.76.4
- Upgrade Velociraptor to version 0.76.4 or later to resolve the cross-organization authorization bypass vulnerability
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,416.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-6863 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-6863 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data