Velociraptor’s SetClientMetadata function performed an incorrect permission check when applying metadata updates on the server. As a result, a user who has only the LABEL_CLIENTS role can change server‑wide metadata values that should normally be modifiable only by an administrator. This bypass of the intended authorization control allows an attacker to alter configuration data that controls how the entire system behaves, potentially undermining security controls, misdirecting traffic, or setting up persistence mechanisms.

The affected vendor is Rapid7, and the product is Velociraptor. No specific versions were disclosed in the advisory, so all installations of Velociraptor that include the vulnerable SetClientMetadata implementation are potentially affected until a fix is applied.

With a CVSS score of 6.5, the risk is moderate. The exploit would be delivered remotely through the API that accepts client metadata updates, and it requires only that the attacker possesses a user account with LABEL_CLIENTS permission. Because EPSS is not available and the issue is not listed in the CISA KEV catalog, the estimated current exploitation probability is uncertain, but any user who can gain LABEL_CLIENTS access should be considered a threat vector for unauthorized configuration changes.