CVE-2026-18860
Received Received - Intake

Privilege Escalation in Velociraptor Org Deletion

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18860
EUVD
EUVD-2026-56183

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velocidex velociraptor 0.77.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18860 is a vulnerability in Velociraptor, a multi-tenant endpoint monitoring tool. It allows administrators of child organizations (Orgs) to delete other organizations by exploiting incorrect permission checks. The system should verify ORG_ADMIN permissions in the ROOT Org but instead checks them in the calling Org, enabling unauthorized deletions.

Detection Guidance

Check Velociraptor server logs for unauthorized Org deletion attempts or suspicious permission changes. Review ACL tokens for child Orgs to see if ORG_ADMIN permissions were incorrectly assigned. Verify server version is below 0.77.2 to confirm exposure.

Impact Analysis

This vulnerability allows unauthorized users with child Org admin privileges to delete other organizations, potentially disrupting services and causing data loss. It compromises the integrity and availability of the Velociraptor deployment but does not directly expose confidential data.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized deletion of organizations in multi-tenant deployments. Child org administrators without proper root org permissions could delete other orgs, potentially violating data integrity and availability requirements under these regulations.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later immediately. Audit all Orgs and remove ORG_ADMIN permissions from child Orgs unless explicitly required in the ROOT Org. Ensure child Org administrators are trusted users with proper ROOT Org permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18860. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart