CVE-2026-78412

EUVD-2026-92485
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
rapid7CNA
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
rapid7velociraptor
𝑥
< 0.77.3
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
http://docs.velociraptor.app/announcements/advisories/cve-2026-78412