CVE-2026-18972

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Score

CVSS 3.1 9.6 Critical

Status

Awaiting Analysis - cve@rapid7.com

Published

2026-08-11

Last modified

2026-10-23

Weaknesses

CWE-290

Affected products

• Velociraptor (Rapid7)

References

• http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/