CVE-2026-18860 Velociraptor incorrect Org deletion permissions check
Child org admins can delete other orgs due to incorrect permission checks, allowing unauthorized data modification and security bypass.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18860?
CVE-2026-18860 is a high-severity missing authorization vulnerability in Rapid7 Velociraptor, published on 11 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Velociraptor allows multi-tenant deployments named "Orgs".
By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment.
Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org.
This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.
Weakness: CWE-280
Which versions are affected by CVE-2026-18860?
How do I fix CVE-2026-18860?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18860 being exploited?
There is no known exploitation of CVE-2026-18860 in the wild and no public exploit code.
Sources
Also known as GHSA-jm4c-88wp-rfjq.