An authorization bypass (CWE-639) exists in the GetUserRoles gRPC API endpoint of Velocidex Velociraptor versions prior to 0.76.5. This flaw allows authenticated users with low privileges to access the full ACL policy for any user by supplying crafted Name and Org parameters in network requests. The vulnerability enables disclosure of roles and permissions across all organizations managed by the product, potentially aiding an attacker in reconnaissance or privilege escalation planning. The CVSS 3.1 base score is 5.0, reflecting network attack vector, low attack complexity, and low privileges required, with impact limited to confidentiality. No vendor advisory or patch information is currently available, and the product is not a cloud service.

The vulnerability allows unauthorized disclosure of access control policies, including roles and permissions, for any user across all organizations within the affected Velocidex Velociraptor deployment. This exposure could facilitate further attacks by revealing sensitive authorization configurations. There is no reported impact on system integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the GetUserRoles API endpoint to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary authentication privileges to users. Follow vendor communications closely for updates on patches or official mitigations.