CVE-2026-78411 — Velociraptor Server Metadata update with Insufficient Permission Check

CVE-2026-78411

Velociraptor Server Metadata update with Insufficient Permission Check PUBLISHED

Description (CNA)

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.3

CWE

CWE-863

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-78411

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.