Rapid7 Velociraptor < 0.75.8 / 0.76.x < 0.76.3 Incorrect Authorization (CVE-2026-6290)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307355);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2026-6290");

  script_name(english:"Rapid7 Velociraptor < 0.75.8 / 0.76.x < 0.76.3 Incorrect Authorization (CVE-2026-6290)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by an incorrect authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Rapid7 Velociraptor installed on the remote host is prior to 0.75.8 or 0.76.x prior to 0.76.3. It is,
therefore, affected by an incorrect authorization vulnerability:

  - Velociraptor contains a vulnerability in the query() plugin which allows access to all orgs with the user's
    current ACL token. This allows an authenticated GUI user with access in one org to use the query() plugin in a
    notebook cell to run VQL queries on other orgs which they may not have access to. The user's permissions in the
    other org are the same as the permissions they have in the org containing the notebook. (CVE-2026-6290)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Rapid7 Velociraptor version 0.75.8 / 0.76.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6290");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rapid7:velociraptor");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("rapid7_velociraptor_win_installed.nbin", "rapid7_velociraptor_nix_installed.nbin", "rapid7_velociraptor_macos_installed.nbin");
  script_require_keys("installed_sw/Rapid7 Velociraptor");

  exit(0);
}


include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Rapid7 Velociraptor', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'fixed_version': '0.75.8'},
        {'min_version': '0.76.0', 'fixed_version': '0.76.3'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);