CVE-2026-18652

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description Velociraptor allows the reading of Stacked result sets through the GUI. Due to a multi-tenant design that stores sub-organizations within the datastore directory, the GUI does not correctly validate requested paths against the prefix deny list. This allows result sets to be read from denied prefixes, specifically enabling a user with read access to the root organization to access result sets belonging to child organizations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.