Velociraptor servers that run on a root organization allow a user with only the reader role to issue an HTTP GET and read any files stored by other organizations, bypassing intended isolation boundaries. This is a cross‑organization authorization bypass (CWE‑863) that permits attackers to read confidential data, compromising the confidentiality of all organizations the server manages.

Rapid7 Velociraptor server builds prior to 0.76.4, including all 0.75.x releases, suffer from the flaw. The vulnerability specifically targets the HTTP API handling the filestore endpoints and does not affect other components of the application.

The CVSS score is 6.8, denoting moderate severity, and the flaw can be exploited remotely via a single authenticated HTTP GET request. No EPSS score is available and the issue is not listed in CISA KEV, indicating no public exploitation has been reported yet. Despite this, the ability to read cross‑organization files makes it a moderate‑risk vulnerability that warrants prompt action.