CVE-2026-19200: CWE-862: Missing Authorization in Rapid7 Velociraptor

The vulnerability arises from an implementation fault in the verify() VQL function of Rapid7 Velociraptor. This function uses the global artifact repository and lacks adequate authorization controls, permitting users with the NOTEBOOK_EDIT permission to overwrite existing artifacts. The vulnerability is classified under CWE-862 (Missing Authorization) and CWE-94 (Improper Control of Generation of Code). It affects Velociraptor versions before 0.77.2. The CVSS 3.1 base score is 8.9, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, and high impact on confidentiality, integrity, and low impact on availability.

An attacker with NOTEBOOK_EDIT permission (such as an analyst role) can exploit this vulnerability to overwrite artifacts in the global repository without proper authorization. This can lead to unauthorized modification of artifacts, potentially compromising the integrity and confidentiality of the system. The vulnerability has a high severity score (CVSS 8.9) indicating significant risk if exploited.

No official patch or remediation level is currently stated in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict NOTEBOOK_EDIT permissions to trusted users only and monitor for any suspicious activity involving artifact modifications.