CVE-2026-18860: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-18860 is an authorization bypass vulnerability in Rapid7's Velociraptor DFIR platform affecting multi-tenant ("Org") deployments. The flaw allows a child organization administrator — who is not a ROOT org administrator — to delete other organizations by exploiting incorrect ORG_ADMIN permission validation. All Velociraptor versions before 0.77.2 on Linux are affected. It was published on August 11, 2026, with a CVSS v3.1 base score of 8.7 (High), assigned by Rapid7 (Github Advisory, Velociraptor Advisory).

The root cause is CWE-280 (Improper Handling of Insufficient Permissions or Privileges): when processing org deletion requests, Velociraptor checked the caller's ORG_ADMIN permission within the calling (child) org context rather than against the ROOT org, where that permission is exclusively meaningful (Github Advisory). Compounding this, child org administrators could self-assign the ORG_ADMIN permission to their own ACL token within their org, since the SetPolicy function did not strip this permission for non-root orgs prior to the fix. The patch (commit dc38bd6) corrects both GetEffectivePolicy and SetPolicy in services/acl_manager/acl_manager.go to enforce that OrgAdmin is always set to false when the config's OrgId is not the root org, and also disables the ORG_ADMIN role/permission in the GUI for non-root orgs (GitHub Commit).

A child org administrator who successfully exploits this vulnerability can delete any other organization within the same Velociraptor deployment, destroying tenant isolation and causing irreversible loss of forensic data, hunt results, and configuration for affected orgs. The integrity and availability impacts are rated High, while there is no direct confidentiality impact (the attacker cannot read other orgs' data, only delete them). In multi-tenant DFIR environments, this could disrupt active incident response operations across multiple customer tenants simultaneously (Github Advisory, Velociraptor Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the publication date (Feedly). The CISA SSVC assessment classifies exploitation as "none" and the attack as not automatable, reflecting the requirement for an authenticated child org administrator account. The EPSS score is approximately 0.304% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain child org admin access: Acquire or compromise an administrator account within any child organization in the target Velociraptor multi-tenant deployment (credentials may be obtained via phishing, credential stuffing, or insider access).
2. Self-assign ORG_ADMIN permission: Using the child org admin account, navigate to user ACL management within the child org and add the ORG_ADMIN permission or org_admin role to the attacker's own ACL token. In vulnerable versions, the server does not strip this permission for non-root orgs.
3. Authenticate to the Velociraptor API: Use the now-elevated ACL token to authenticate to the Velociraptor server API (typically via the web GUI or gRPC API endpoint).
4. Trigger org deletion: Issue an org deletion request targeting any other organization in the deployment. The server incorrectly validates the ORG_ADMIN permission against the calling (child) org context rather than the ROOT org, granting the operation.
5. Impact: The targeted org and all associated data (hunts, artifacts, client enrollments) are deleted, disrupting operations for that tenant (GitHub Commit, Velociraptor Advisory).

• Logs: Velociraptor audit logs showing an org deletion event initiated by a user who is not a ROOT org administrator; ACL policy change events granting ORG_ADMIN or org_admin role to a user within a child org.
• Logs: Server logs recording SetPolicy calls that include OrgAdmin: true or org_admin role for a non-root org context (on unpatched versions).
• Application Behavior: Unexpected disappearance of one or more child organizations from the Velociraptor GUI or API org listing.
• Network: API calls to org management endpoints (e.g., org deletion gRPC methods) originating from accounts not associated with ROOT org administration.

Rapid7 has released Velociraptor version 0.77.2 which fixes this vulnerability by enforcing that ORG_ADMIN permission checks and assignments are always evaluated against the ROOT org context (Velociraptor Advisory, GitHub Commit). All deployments running versions prior to 0.77.2 should upgrade immediately. As an interim measure, administrators should audit all child org ACL tokens and remove any ORG_ADMIN permission or org_admin role that has been granted to non-ROOT org users, and implement additional logging and alerting on org deletion events.