The vulnerability CVE-2026-64952 in Rapid7 Velociraptor involves an incorrect authorization check in the hunt_delete() VQL function. The function permits deletion of hunts by users possessing the COLLECT_CLIENT permission rather than requiring the DELETE_RESULTS permission. Since COLLECT_CLIENT is commonly granted to the investigator role, this flaw enables users with investigator-level privileges to delete hunts, a capability that should be restricted to administrators. The affected versions are those before 0.77.2. The CVSS 3.1 score is 6.5 (medium severity), reflecting that the vulnerability is remotely exploitable with low complexity and requires privileges but no user interaction, causing high impact on integrity without affecting confidentiality or availability.

An attacker or user with the COLLECT_CLIENT permission can delete hunts in Velociraptor, which should only be possible for users with DELETE_RESULTS permission. This leads to unauthorized modification of data (integrity impact) but does not affect confidentiality or availability. The vulnerability could disrupt forensic or investigative workflows by removing critical hunt data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict assignment of the COLLECT_CLIENT permission to trusted users only, and monitor for unauthorized hunt deletions. Avoid granting investigator roles broadly. Follow vendor advisories for updates on patches or official fixes.