CVE-2026-18860: CWE-280 Improper handling of insufficient permissions or privileges in Rapid7 Velociraptor
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
AI Analysis
Technical Summary
Velociraptor supports multi-tenant deployments with a ROOT org and child orgs, each with distinct permissions. The vulnerability occurs because the Velociraptor server incorrectly verifies the ORG_ADMIN permission for deleting organizations within the calling org rather than the ROOT org. Child org administrators can add ORG_ADMIN permission to their ACL tokens within their own org, allowing them to delete other orgs without having ROOT org admin rights. This is an improper handling of insufficient permissions (CWE-280) leading to unauthorized deletion of organizations.
Potential Impact
An attacker who is an administrator in a child org but not in the ROOT org can delete other organizations within the Velociraptor deployment. This can lead to disruption of service and potential loss of data or tenant isolation, impacting the integrity and availability of the multi-tenant environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict child org administrators' ability to modify their ACL tokens or perform org deletion actions. Monitor for unusual deletion activities and apply principle of least privilege to org admin roles.
CVE-2026-18860: CWE-280 Improper handling of insufficient permissions or privileges in Rapid7 Velociraptor
Description
Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
CVSS v3.1
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Velociraptor supports multi-tenant deployments with a ROOT org and child orgs, each with distinct permissions. The vulnerability occurs because the Velociraptor server incorrectly verifies the ORG_ADMIN permission for deleting organizations within the calling org rather than the ROOT org. Child org administrators can add ORG_ADMIN permission to their ACL tokens within their own org, allowing them to delete other orgs without having ROOT org admin rights. This is an improper handling of insufficient permissions (CWE-280) leading to unauthorized deletion of organizations.
Potential Impact
An attacker who is an administrator in a child org but not in the ROOT org can delete other organizations within the Velociraptor deployment. This can lead to disruption of service and potential loss of data or tenant isolation, impacting the integrity and availability of the multi-tenant environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict child org administrators' ability to modify their ACL tokens or perform org deletion actions. Monitor for unusual deletion activities and apply principle of least privilege to org admin roles.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-08-04T16:15:03.926Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b3853bf8831d539e79e40
Added to database: 08/11/2026, 14:57:23 UTC
Last enriched: 08/11/2026, 15:12:29 UTC
Last updated: 09/07/2026, 10:52:07 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.