CVE-2026-18860: Velociraptor Privilege Escalation Flaw

CVE-2026-18860 Overview

CVE-2026-18860 is a privilege management flaw in Velociraptor, an open-source digital forensics and incident response (DFIR) platform. Velociraptor supports multi-tenant deployments through a construct called Orgs, with a default ROOT org and optional child orgs. The vulnerability stems from the server checking the ORG_ADMIN permission on the caller's current org rather than on the ROOT org when authorizing org deletion. A child org administrator can add ORG_ADMIN to their own ACL token within their tenant and then delete sibling orgs. This breaks tenant isolation in shared Velociraptor deployments and enables cross-tenant destructive actions [CWE-280].

Critical Impact
An authenticated administrator of a child org can delete other orgs in the same Velociraptor deployment, causing loss of tenant data and availability without ROOT org privileges.

Affected Products

Velociraptor server (multi-tenant deployments using Orgs)
Deployments where child org administrators exist alongside the ROOT org
Versions prior to the fix in commit dc38bd6a7e12a678cd79e726bdd1ded4eed75967

Discovery Timeline

2026-08-11 - CVE-2026-18860 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18860

Vulnerability Analysis

Velociraptor implements multi-tenancy through Orgs. The ROOT org is the top-level tenant, and administrators can create child orgs for other teams or customers. Each user carries an ACL token that grants permissions scoped to a specific org.

Org lifecycle operations, including deletion, are administrative actions that should be restricted to ROOT org administrators. The server-side authorization logic instead evaluated the ORG_ADMIN permission against the caller's current org context. Any user holding ORG_ADMIN inside their own child org therefore satisfied the check.

Because a child org administrator controls the ACL tokens issued within that tenant, they can grant themselves ORG_ADMIN inside their org. The server then accepts this token when the user invokes org-deletion APIs, permitting deletion of unrelated orgs. The result is a broken tenant boundary in shared deployments where isolation between tenants is a core assumption.

Root Cause

The underlying weakness is improper handling of insufficient permissions, classified as [CWE-280]. The permission check for ORG_ADMIN on org-management operations was scoped to the calling org instead of the ROOT org, where administrative authority actually resides.

Attack Vector

Exploitation requires an authenticated user with administrator rights in a child org. The attacker adds ORG_ADMIN to their own ACL token, then calls the org-deletion API against a target org identifier. No user interaction from other tenants is required, and the action executes over the network against the Velociraptor API.

// Security patch in api/tables/table.go
// Source: https://github.com/Velocidex/velociraptor/commit/dc38bd6a7e12a678cd79e726bdd1ded4eed75967
// Bugfix: Only set ORG_ADMIN permission on the root org. (#4931)

		in.Rows = 100
	}

+	// The caller asked for rows after the last one. We don't really
+	// know the columns because reading past the end of the table will
+	// give no rows. So for this case we read the first row and return
+	// the columns from there.
+	if in.StartRow > uint64(result.TotalRows) {
+		res := ConvertRowsToTableResponse(
+			rs_reader.Rows(ctx), result, in.Timezone, 1)
+		res.Rows = nil
+		return res, nil
+	}
+
	// Seek to the row we need.
	err = rs_reader.SeekToRow(int64(in.StartRow))
	if errors.Is(err, io.EOF) {

The corresponding front-end change hardens URL parsing in gui/velociraptor/src/components/core/api-service.jsx to accept only http: and https: schemes. See the GitHub Velociraptor Commit Update for the complete patch set.

Detection Methods for CVE-2026-18860

Indicators of Compromise

Unexpected org-deletion events in Velociraptor audit logs originating from users who are not ROOT org administrators.
ACL token modifications inside child orgs that add the ORG_ADMIN permission to non-ROOT administrators.
Missing or unreachable orgs that were present in a prior configuration snapshot.

Detection Strategies

Review Velociraptor server audit logs for DeleteOrg API calls and correlate the caller's org context against the target org identifier.
Alert when any principal outside the ROOT org invokes org-management endpoints.
Baseline ACL token contents per user and flag additions of ORG_ADMIN in non-ROOT orgs.

Monitoring Recommendations

Forward Velociraptor API and audit logs to a central SIEM or data lake for retention and cross-tenant correlation.
Monitor administrative API endpoints for authorization anomalies and privilege changes.
Track org inventory over time and alert on unexpected deletions or configuration drift.

How to Mitigate CVE-2026-18860

Immediate Actions Required

Upgrade Velociraptor to a build that includes commit dc38bd6a7e12a678cd79e726bdd1ded4eed75967 or later.
Audit all child org ACL tokens and remove ORG_ADMIN from any user who should not hold ROOT-level administrative authority.
Review recent org-deletion activity and restore any orgs removed by unauthorized child-org administrators.

Patch Information

The fix ensures that ORG_ADMIN is only honored on the ROOT org for org-management operations. See the Velociraptor CVE-2026-18860 Advisory and the GitHub Velociraptor Commit Update for release details and the exact code changes.

Workarounds

Restrict child org administration to trusted operators until the patched release is deployed.
Avoid granting ORG_ADMIN to any user in a child org; keep org-management strictly within the ROOT org.
Where feasible, separate high-sensitivity tenants into independent Velociraptor deployments rather than child orgs.

bash

# Verify Velociraptor server version and installed patch commit
velociraptor version

# List all orgs (run as a ROOT org admin) and audit administrators
velociraptor --config server.config.yaml orgs ls

# Review recent org-management activity in audit logs
grep -Ei 'DeleteOrg|ORG_ADMIN' /var/log/velociraptor/audit.log