{"id":"CVE-2026-18972","aliases":["EUVD-2026-56127","GHSA-62g2-q3w2-xf47"],"status":"published","title":"Velociraptor authenticated identity-spoofing vulnerability","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0035,"percentile":0.28832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-08-11T12:30:52Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"rapid7","product":"velociraptor"}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18972","tags":["advisory"]},{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-18972"},{"url":"https://github.com/advisories/GHSA-62g2-q3w2-xf47"},{"url":"https://github.com/Velocidex/velociraptor/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18972.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-18972","title":"Velociraptor authenticated identity-spoofing vulnerability","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","status":"published","published":"2026-08-11T12:30:52.574Z","modified":"2026-08-11T13:51:00.275Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-56127","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","status":"published","published":"2026-08-11T12:30:52Z","modified":"2026-08-11T13:51:00Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:02:00.294626Z"}],"ghsa":[{"id":"GHSA-62g2-q3w2-xf47","title":"An authenticated attacker can spoof another GUI user's identity by sending their request with the...","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","status":"published","published":"2026-08-11T15:32:36Z","modified":"2026-08-11T15:32:40Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:10:17.573081Z"}],"nvd":[{"id":"CVE-2026-18972","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","status":"published","published":"2026-08-11T13:17:56.997Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:36.499002Z"}],"osv":[{"id":"CVE-2026-18972","title":"Velociraptor authenticated identity-spoofing vulnerability","description":"An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.","status":"published","published":"2026-08-11T12:30:52.574Z","modified":"2026-10-28T02:30:44.413025141Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:44:58.024074Z"}]}}