CVE-2026-64952

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

The hunt_delete() VQL function allows deleting hunts.

Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Rapid7	Velociraptor	< 0.77.2

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-64952/

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-649548.2Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLE CVE-2026-649556.1When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary ex CVE-2026-649587.5An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a messag CVE-2026-649599.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerabi CVE-2026-64965.4A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the comp CVE-2026-649608.7ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, f CVE-2026-649616.3ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values req CVE-2026-649625.1ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, CVE-2026-649632.3A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FI CVE-2026-649646.3ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functional CVE-2026-649655.3ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a stud CVE-2026-649668.7ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload an