CVE-2026-18635

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.77.2

Description The VQL query() plugin allows executing a VQL query within a different organization or user context. To perform this action, the calling user must possess the IMPERSONATE permission. The issue arises because the software evaluates this permission against the caller's organization rather than the target organization. Consequently, an administrator from one organization can impersonate a user in another organization, even if they lack the IMPERSONATE permission within that target organization.

Recommendations Update to version 0.77.2 or later.