Rapid7 Velociraptor Cross-Organization Authorization Bypass Vulnerability

A cross-organization authorization bypass vulnerability has been identified in the Velociraptor HTTP API, affecting versions prior to 0.76.4. This vulnerability allows a user with the reader role in the root organization to access files from other organizations without explicit permissions. However, the issue does not reverse; users with read access to a sub-organization cannot access files from other organizations or the root organization.

Impact

Exploitation of this vulnerability allows unauthorized access to files across different organizations, bypassing established permission controls.

Remediation

Users should upgrade to Velociraptor version 0.76.4 or 0.75.9, depending on their current release.