The hunt_delete() VQL function was found to delete hunts without requiring the correct permission. The permission check was incorrectly limited to COLLECT_CLIENT, a permission normally granted to investigators, rather than the stricter DELETE_RESULTS permission reserved for administrators. This flaw allows an authenticated user with investigator-level access to remove hunts, resulting in removal of investigative data and potentially erasing evidence.

Rapid7 Velociraptor is affected. All versions that have not applied the patch are vulnerable; the advisory references no specific version range.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack vector involves an authenticated user possessing the COLLECT_CLIENT permission, which attackers could steal or compromise credentials for. Once authenticated, the user can invoke the hunt_delete() function and delete hunts without further authorization checks.