Rapid7 Velociraptor versions before 0.76.3 contain an authorization bypass vulnerability (CWE-863) in the query() plugin. Authenticated users with access to one organization can leverage their ACL token to execute VQL queries on other organizations they should not have access to, inheriting their original permissions in those organizations. This flaw allows unauthorized cross-organization data access within the Velociraptor GUI environment. The vulnerability has a CVSS 3.1 score of 8.0, indicating high severity. No vendor-provided patch or official remediation level is currently documented, and the product is not a cloud service, so remediation depends on vendor updates.

An authenticated user with legitimate access to one organization can access data and perform queries on other organizations within the Velociraptor environment without proper authorization checks. This can lead to unauthorized disclosure and potential manipulation of data across organizational boundaries, violating access control policies. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict GUI user access to trusted personnel only and monitor for unusual query activity. Avoid sharing ACL tokens across organizations. Follow Rapid7's official channels for updates on patches or workarounds.