CVE-2026-18860: CWE-280 Improper handling of insufficient permissions or privileges in Rapid7 Velociraptor
CVE-2026-18860 is a vulnerability in Rapid7 Velociraptor affecting multi-tenant deployments. It allows administrators of child organizations to delete other organizations by exploiting improper permission checks. The flaw arises because the server checks ORG_ADMIN permissions within the calling org instead of the ROOT org, enabling privilege escalation within the deployment.
AI Analysis
Technical Summary
Velociraptor supports multi-tenant deployments with a ROOT org and child orgs, each with distinct permissions. The vulnerability occurs because the Velociraptor server incorrectly verifies the ORG_ADMIN permission for deleting organizations within the calling org rather than the ROOT org. Child org administrators can add ORG_ADMIN permission to their ACL tokens within their own org, allowing them to delete other orgs without having ROOT org admin rights. This is an improper handling of insufficient permissions (CWE-280) leading to unauthorized deletion of organizations.
Potential Impact
An attacker who is an administrator in a child org but not in the ROOT org can delete other organizations within the Velociraptor deployment. This can lead to disruption of service and potential loss of data or tenant isolation, impacting the integrity and availability of the multi-tenant environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict child org administrators' ability to modify their ACL tokens or perform org deletion actions. Monitor for unusual deletion activities and apply principle of least privilege to org admin roles.
CVE-2026-18860: CWE-280 Improper handling of insufficient permissions or privileges in Rapid7 Velociraptor
Description
CVE-2026-18860 is a vulnerability in Rapid7 Velociraptor affecting multi-tenant deployments. It allows administrators of child organizations to delete other organizations by exploiting improper permission checks. The flaw arises because the server checks ORG_ADMIN permissions within the calling org instead of the ROOT org, enabling privilege escalation within the deployment.
CVSS v3.1
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Velociraptor supports multi-tenant deployments with a ROOT org and child orgs, each with distinct permissions. The vulnerability occurs because the Velociraptor server incorrectly verifies the ORG_ADMIN permission for deleting organizations within the calling org rather than the ROOT org. Child org administrators can add ORG_ADMIN permission to their ACL tokens within their own org, allowing them to delete other orgs without having ROOT org admin rights. This is an improper handling of insufficient permissions (CWE-280) leading to unauthorized deletion of organizations.
Potential Impact
An attacker who is an administrator in a child org but not in the ROOT org can delete other organizations within the Velociraptor deployment. This can lead to disruption of service and potential loss of data or tenant isolation, impacting the integrity and availability of the multi-tenant environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict child org administrators' ability to modify their ACL tokens or perform org deletion actions. Monitor for unusual deletion activities and apply principle of least privilege to org admin roles.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-08-04T16:15:03.926Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b3853bf8831d539e79e40
Added to database: 08/11/2026, 14:57:23 UTC
Last enriched: 08/11/2026, 15:12:29 UTC
Last updated: 08/11/2026, 15:12:29 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.