CVE-2026-78412— WatchEvent API streams another organization's live events
Quick assessment
Affected
Rapid7 Velociraptor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Velociraptor 的 WatchEvent gRPC API 允许指定从哪个组织（OrgId）流式传输事件。然而，服务器在检查 API 权限时，是将请求者与调用者所属的组织（Caller's Org）进行比对，而不是与请求指定的目标组织（Requested Org）进行比对。这种权限验证逻辑错误导致一个拥有某个组织 API 访问权限的用户，可以读取其他其无权访问的组织的事件数据。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78412
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WatchEvent API streams another organization's live events
Source: CVE Program / CVE List V5
Vulnerability Description
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Velociraptor | 0 ~ 0.77.3 | - |
|
II. Public POCs for CVE-2026-78412
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78412
请登录查看更多情报信息。
Other References for CVE-2026-78412 (1)
Same Patch Batch · Rapid7 · 2026-10-05 · 3 CVEs total
| CVE-2026-78411 | 6.5 MEDIUM | Velociraptor Server Metadata update with Insufficient Permission Check |
| CVE-2026-78413 | 5.5 MEDIUM | Velociraptor privilege escalation via SysmonLogForward client monitoring artifact |
IV. Related Vulnerabilities
Same product: Velociraptor
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis -
CVE-2026-77798
Velociraptor Authenticated Denial of Service -
CVE-2026-77797
Velociraptor Prefetch parser out of bounds -
CVE-2026-19072
Velociraptor Investigator reaches SuperUser via hunt Effecti
Same vendor: Rapid7
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis -
CVE-2026-97228
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export S -
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in In -
CVE-2026-77798
Velociraptor Authenticated Denial of Service
Same weakness: CWE-639
-
CVE-2026-97305
WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0 -
CVE-2026-97070
WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Obj -
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEn -
CVE-2026-105633
Plane: Issue Attachment Ownership Hijacking via Missing `iss -
CVE-2026-105631
Plane: asset download endpoints scope file lookups to the wo
V. Comments for CVE-2026-78412
No comments yet