CVE-2026-78412: CWE-639 Authorization bypass through User-Controlled key in Rapid7 Velociraptor

The vulnerability in Rapid7 Velociraptor (CVE-2026-78412) arises because the WatchEvent gRPC API permits clients to specify the OrgId of the organization whose events they want to stream. However, the server only verifies API permissions against the caller's own organization, not the requested OrgId. This authorization bypass (CWE-639) allows an attacker with API access in one organization to access event data from other organizations they should not have access to. The issue affects versions >=0 and <0.77.3 of Velociraptor. No known exploits in the wild have been reported, and no vendor patch links are provided in the data.

An attacker with API access in one organization can read event data from other organizations without authorization, potentially exposing sensitive event information. The vulnerability does not affect integrity or availability but compromises confidentiality of event data across organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users and monitor for unusual access patterns. Avoid sharing API credentials across organizations.