CVE-2026-7573 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations

What is CVE-2026-7573?

CVE-2026-7573 is a medium-severity missing authorization vulnerability in Velocidex velociraptor, published on 6 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege user to retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters via a network request.

Weakness: CWE-639

Which versions are affected by CVE-2026-7573?

3 open source packages ship an affected version, including www.velocidex.com/golang/velociraptor. It affects 1 product.

Products include Rapid7 Velociraptor.

How do I fix CVE-2026-7573?

Upgrade www.velocidex.com/golang/velociraptor to 0.76.5 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-7573 being exploited?

There is no known exploitation of CVE-2026-7573 in the wild and no public exploit code.

Other vulnerabilities in Velocidex velociraptor

• CVE-2023-0242 Insufficient permission check in the VQL copy() function High 8.8
• CVE-2023-5950 Rapid7 Velociraptor Reflected XSS High 8.6
• CVE-2026-5329 Rapid7 Velociraptor Improper Input Validation in Client Message Handler High 8.5
• CVE-2026-6290 Velociraptor Query() Plugin Misapplies Permissions To Orgs High 8.0
• CVE-2025-14728 Rapid7 Velociraptor Directory Traversal Vulnerability Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3c93-g9g6-p5j4, GO-2026-5078.