Rapid7 Velociraptor versions prior to 0.76.3 are vulnerable to an authorization bypass that allows authenticated users to execute unauthorized queries across organizational boundaries.

This is an improper authorization flaw (CWE-863) within the query() plugin that permits an authenticated user to leverage their existing ACL token to run VQL queries in organizations where they lack explicit authorization. The impact is limited to the permissions the user currently holds in their originating organization.

The ability for a user to bypass organizational access controls poses a significant risk to data confidentiality and integrity. Given the CVSS score of 8.0, this high severity flaw could allow a compromised or malicious insider account to escalate their reach across the Velociraptor environment, potentially leading to unauthorized data exfiltration or system manipulation across multiple isolated business units.

Immediate Action: Update all instances of Velociraptor to version 0.76.3 or later to resolve the query() plugin authorization logic.

Proactive Monitoring: Review audit logs for suspicious VQL query execution patterns, specifically looking for queries targeting organizational objects outside the user's assigned scope.

Compensating Controls: Restrict access to the notebook and query() plugin functionalities to a limited set of trusted administrators until patching can be completed.

Public Exploit Available: False (exploit_available: unknown)

This vulnerability represents a critical breakdown in multi-tenant access control that must be addressed promptly. Organizations using Velociraptor in multi-organization environments should prioritize the update to version 0.76.3 to prevent unauthorized cross-org data access and ensure the integrity of the platform's security boundaries.