CVE-2026-78412

MEDIUMCVSS 4.9

Description

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.

Timeline

Published:October 5th, 2026 5:17 PM

Last modified:October 5th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

http://docs.velociraptor.app/announcements/advisories/cve-2026-78412

Source: NIST NVD · Data may lag official sources by up to one minute