CVE-2026-64952 — Velociraptor Hunt Deletion With Insufficient Permission Check

CVE-2026-64952

Velociraptor Hunt Deletion With Insufficient Permission Check PUBLISHED

Description (CNA)

The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.2

CWE

CWE-863

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-64952/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.