CVE-2026-78412 — WatchEvent API streams another organization's live events

CVE-2026-78412

WatchEvent API streams another organization's live events PUBLISHED

Description (CNA)

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.3

CWE

CWE-639

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-78412

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.