CVE-2026-7573
GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.
| CWE | CWE-639 |
| Vendor | velocidex |
| Product | velociraptor |
| Published | May 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for velocidex velociraptor
Be the first to know when new medium vulnerabilities affecting velocidex velociraptor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Velocidex / velociraptor
0 < 0.76.5
References
Credits
michaelddickenson