CVE-2026-78411 — Velociraptor Server Metadata update with Insufficient Permission Check
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server…
Published: 2026-10-05 · CVSS: 6.5 · CVSS 3.1
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7