The GetUserRoles gRPC API in Velocidex Velociraptor contains an authorization bypass flaw (CWE‑639). If an attacker can authentically log in with a low‑privilege account, they may supply a target user’s name and organization in the request and receive the entire ACL policy for that user, revealing the roles and permissions granted to them. This grants wide visibility into the authorization structure, which could be leveraged to plan privilege escalation attacks.

Velocidex Velociraptor installations running any version earlier than 0.76.5 are vulnerable; the flaw exists in all releases before this update.

The vulnerability receives a CVSS score of 5.0 and is currently not tracked in the KEV catalog, with no EPSS data available. It requires network access to the gRPC endpoint and valid user credentials, so it can be exploited by legitimate users with low permissions. Because the impact is the disclosure of internal role information rather than service disruption or direct code execution, the overall risk is medium, but the information gained could facilitate subsequent attacks.