CVE-2026-78412

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description The WatchEvent gRPC API allows the specification of an OrgId to determine which organization's events should be streamed. The server incorrectly validates API permissions against the caller's organization rather than the requested organization. This flaw enables a user with API access in one organization to read events from another organization without authorization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.