CVE-2026-7573
MEDIUMGetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations
Title source: cnaDescription
An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
https://docs.velociraptor.app/announcements/advisories/cve-2026-7573/
Scores
CVSS v3
5.0
EPSS
0.0001
EPSS Percentile
0.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-639
Status
published
Products (2)
golang/velociraptor
0 - 0.76.5Go
Velocidex/velociraptor
< 0.76.5
Published
May 06, 2026
Tracked Since
May 06, 2026