Velociraptor permits scheduling new collections via VQL queries in notebooks, requiring the COLLECT_CLIENT permission. However, this permission check is bypassed if a user can execute a VQL query that resets the authorization provider. As a result, a user with the analyst role (who can run arbitrary VQL) can escalate privileges to investigator role capabilities by launching new collections. This is a missing authorization vulnerability categorized under CWE-862. The issue affects versions before 0.77.2 and has a CVSS 3.1 score of 8.2, indicating high severity. No vendor advisory or patch information is currently available.

An attacker with analyst-level access can escalate privileges to investigator-level by bypassing authorization controls, enabling them to schedule new collections that they normally would not have permission to perform. This could lead to unauthorized data collection and potential exposure of sensitive information. The vulnerability does not affect availability but impacts confidentiality and integrity significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to run arbitrary VQL queries to trusted users only, and monitor for unusual activity related to authorization provider resets or collection scheduling.