CVE-2026-78411
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 05, 2026
Vendor
unknown
Description
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.