CVE-2026-7573: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-7573 is an authorization bypass vulnerability (CWE-639) in the GetUserRoles gRPC API endpoint of Velocidex Velociraptor, an open-source digital forensics and incident response (DFIR) platform. Any authenticated low-privilege user can retrieve the complete ACL policy — including roles and permissions — for any user across all organizations by supplying arbitrary Name and Org parameters in a network request. All Velociraptor versions below 0.76.5 are affected; version 0.76.5 contains the fix. The vulnerability was published on May 6, 2026, with a CVSS v3.1 base score of 7.7 (High) per NVD, though GitHub Advisory Database rates it 5.0 (Moderate) (GitHub Advisory, Velociraptor Advisory).

The root cause is an authorization bypass through user-controlled key (CWE-639): the GetUserRoles gRPC API endpoint fails to validate whether the requesting user is authorized to query role and permission data for a target user or organization other than their own. An attacker with any valid low-privilege account can craft a gRPC request to this endpoint, supplying arbitrary Name (username) and Org (organization identifier) parameters to enumerate ACL policies for any user across any organization in the Velociraptor deployment. No elevated privileges, special configuration, or user interaction is required beyond holding a valid session. The vulnerability is network-accessible and low-complexity to exploit (GitHub Advisory, Velociraptor Advisory).

Successful exploitation allows a low-privilege attacker to enumerate the complete ACL policy — all roles and permissions — for every user across all organizations managed by the Velociraptor server. This is a confidentiality-only impact (no integrity or availability impact), but the exposed data is operationally sensitive: knowing which accounts hold administrative or investigator roles enables targeted privilege escalation attempts, social engineering, or lateral movement planning within the DFIR environment. In multi-tenant or enterprise deployments, cross-organizational ACL exposure amplifies the risk by revealing the full permission structure of the platform (GitHub Advisory, Velociraptor Advisory).

1. Obtain valid credentials: Acquire any low-privilege Velociraptor account through phishing, credential stuffing, or insider access — no administrative rights are needed.
2. Identify the gRPC endpoint: Locate the Velociraptor server's gRPC API address (typically exposed on the server's configured API port, e.g., 8001).
3. Craft a gRPC request: Using a gRPC client (e.g., grpcurl or a custom Go/Python client), call the GetUserRoles API method with arbitrary Name (target username) and Org (target organization identifier) parameters.
4. Enumerate ACL policies: Iterate over known or guessed usernames and organization names to retrieve the complete roles and permissions for each target user across all organizations.
5. Leverage gathered intelligence: Use the enumerated ACL data to identify high-privilege accounts (e.g., administrators, investigators) for targeted follow-on attacks such as credential theft, privilege escalation, or social engineering (GitHub Advisory, Velociraptor Advisory).

• Network: Unusual or repeated gRPC requests to the GetUserRoles API endpoint from low-privilege user accounts; requests targeting multiple different Name and Org parameter combinations in rapid succession from a single source IP.
• Logs: Velociraptor server API access logs showing a low-privilege user account querying GetUserRoles for usernames or organizations other than their own; high volume of GetUserRoles calls from a single authenticated session.
• Behavioral: A single user account systematically enumerating all organization identifiers or usernames via the gRPC API, which would be anomalous compared to normal single-user role lookups.

The primary remediation is to upgrade Velocidex Velociraptor to version 0.76.5 or later, which contains the fix for this authorization bypass (GitHub Advisory, Velociraptor Advisory). As interim workarounds, administrators should restrict network access to the Velociraptor gRPC API endpoint to trusted systems and networks only, implement network segmentation to limit exposure of internal APIs, and audit access logs for any unauthorized GetUserRoles queries. Reviewing and tightening ACL policies to minimize the number of accounts with any level of access to the server is also recommended.