A deadlock condition exists in Velociraptor’s user management module that can be triggered by authenticated users. The lock management bug causes the system to wait indefinitely for a lock that is never released, leading to a hang of the application and ultimately denying legitimate user access. The weakness is a classic lock ordering failure (CWE‑833) and affects only availability, not confidentiality or integrity.

Rapid7 Velociraptor is the affected vendor. No specific affected version information is provided, so any installed instance of Velociraptor could be vulnerable until updated.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in KEV. The likely attack vector requires an authenticated session; an attacker with valid credentials can trigger the deadlock by performing user management operations. Attack conditions include the presence of simultaneous or repeated user actions that lead to a lock contention scenario.