CVE-2026-18860

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18860
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18860.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18860
Published
2026-08-11T14:52:55.529Z
Modified
2026-08-13T04:02:21.213670414Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H CVSS Calculator
Summary
Velociraptor incorrect Org deletion permissions check
Details

Velociraptor allows multi-tenant deployments named "Orgs".

By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment.

Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org.

This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.

Database specific 
{
    "cna_assigner": "rapid7",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18860.json",
    "cwe_ids": [
        "CWE-280"
    ]
}
References

Affected packages

Git / github.com/velocidex/velociraptor

Affected ranges

Type
GIT
Repo
https://github.com/velocidex/velociraptor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dc38bd6a7e12a678cd79e726bdd1ded4eed75967
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.77.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
v0.*
v0.1
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-1
v0.5.6
v0.5.7
v0.5.8-rc1
v0.5.9-rc1
v0.6.0-rc1
v0.6.1-rc1
v0.6.2-rc1
v0.6.3-rc1
v0.6.4-rc1
v0.6.7-rc1
v0.6.8-rc1
v0.7.0
v0.7.0-rc1
v0.72
v0.73
v0.74
v0.75
v0.76.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18860.json"