The Velociraptor gRPC API includes a VFSGetBuffer endpoint that reads files from the datastore. To restrict access, it performs a prefix check against denied prefixes to prevent reading sensitive files or accessing other organizations' data. Due to a flaw, this prefix check can be bypassed, allowing users with read permission in the ROOT organization to access files from other organizations without proper authorization. This constitutes an authentication bypass vulnerability categorized under CWE-288. The issue affects Velociraptor versions before 0.77.2. No official remediation or patch has been documented yet.

An attacker with read permission in the ROOT organization can bypass access controls to read files from other organizations within the Velociraptor datastore. This leads to unauthorized disclosure of sensitive information across organizational boundaries. The vulnerability does not impact integrity or availability but results in a confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict read permissions in the ROOT organization to trusted users only and monitor access to sensitive files. Avoid granting broad read permissions that could be exploited via this vulnerability.