CVE-2026-78412: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-78412 is an authorization bypass vulnerability in Rapid7's Velociraptor digital forensics and incident response platform, specifically affecting the WatchEvent gRPC API. The flaw allows an authenticated user with API access in one organization to read event streams from other organizations by specifying a different OrgId parameter, because the server validates permissions against the caller's own organization rather than the requested one. All Velociraptor versions prior to 0.77.3 are affected. It carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the WatchEvent gRPC API accepts a caller-supplied OrgId parameter to specify which organization's events to stream, but the server-side permission check is performed against the caller's own organization context rather than the target organization identified by OrgId. This means any authenticated API user can substitute an arbitrary OrgId value in their gRPC request to access event streams belonging to organizations they have no legitimate access to. No special privileges beyond standard API access in any single organization are required to exploit this flaw (GitHub Advisory, Velociraptor Advisory).

Successful exploitation allows an authenticated attacker to read sensitive event data — including forensic telemetry, endpoint monitoring events, and investigation artifacts — from any organization hosted on the same Velociraptor multi-tenant instance, bypassing all intended access controls. The confidentiality impact is rated High, as the attacker gains full visibility into another organization's event stream. There is no integrity or availability impact, but exposure of forensic investigation data across organizational boundaries could compromise active incident response operations or reveal sensitive endpoint activity (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, as it requires an authenticated API session. The EPSS score is approximately 0.222% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Obtain API Access: Acquire valid API credentials for any organization on the target Velociraptor multi-tenant server (e.g., through legitimate access, credential theft, or social engineering).
2. Identify Target Organization: Enumerate or guess valid OrgId values for other organizations on the same Velociraptor instance. Organization IDs may be discoverable through other API calls or administrative interfaces.
3. Craft Malicious gRPC Request: Using a gRPC client (e.g., grpcurl or a custom script using the Velociraptor API), call the WatchEvent API endpoint and supply the OrgId of the target organization rather than the caller's own organization.
4. Receive Unauthorized Event Stream: The server validates permissions against the caller's own org (which passes), then streams events from the specified target org, granting the attacker full read access to that organization's event data (GitHub Advisory, Velociraptor Advisory).

• Logs: Velociraptor API audit logs showing WatchEvent gRPC calls where the OrgId in the request does not match the authenticated user's assigned organization.
• Network: Unusual or repeated gRPC connections to the Velociraptor API port from API clients that do not normally interact with certain organizational event streams.
• Behavioral: A single API credential or service account making WatchEvent requests referencing multiple distinct OrgId values, particularly those outside the account's normal organizational scope.

Rapid7 has released Velociraptor version 0.77.3, which fixes the authorization check in the WatchEvent gRPC API to validate permissions against the requested organization rather than the caller's organization. All users running versions prior to 0.77.3 should upgrade immediately. As an interim measure, restrict API access to the minimum necessary set of trusted users and monitor API audit logs for cross-organization WatchEvent requests (GitHub Advisory, Velociraptor Advisory).