Threats tagged 'ghsa-3c93-g9g6-p5j4'

Velocidex Velociraptor versions prior to 0.76.5 contain an authorization bypass vulnerability in the GetUserRoles gRPC API endpoint. This flaw allows any authenticated user with low privileges to retrieve the complete access control list (ACL) policy, including roles and permissions, for any user across all organizations by manipulating the Name and Org parameters in a network request. The vulnerability is fixed in version 0.76.5.