Velociraptor’s VQL query() plugin is intended to run queries inside a designated organization or user context. However, versions before 0.77.2 incorrectly validate the IMPERSONATE permission against the caller’s organization instead of the target organization. This flaw permits an administrator in one org to impersonate any user in another org, even if that user in the target org has not been granted IMPERSONATE rights. An attacker could use this to read or modify sensitive data, perform privileged actions, or exfiltrate information in other orgs, thereby breaching confidentiality, integrity, and potentially availability of those systems. The weakness is classified as CWE‑863 (Permission Management Failure).

Rapid7 Velociraptor deployments older than version 0.77.2 are affected. The vulnerability applies to all installations where an organizing role can issue VQL via the query() plugin, including public and private clusters. No specific platform or environment constraints are noted beyond the version requirement.

The CVSS score of 7.2 indicates high severity. EPSS information is not publicly available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is an insider or compromised administrator account with IMPERSONATE permissions, who then attempts to run a query targeting a different organization. Successful exploitation requires the offender to have IMPERSONATE rights in their own org; no additional network or privilege escalation is needed. Once executed, the attacker gains the permissions and data access normally available to the impersonated user in the target org.