MEDIUM 4.9 NVD

CVE-2026-78412

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the call

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-78412

Published: 2026-10-05 · Source: NVD · Feed updated: 2026-10-06

This medium severity vulnerability with a CVSS score of 4.9 was published on 2026-10-05 via NVD.

vulnfeed aggregates 7729 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.