CVE-2026-18638

This CVE reveals a deeper failure than a simple missing authorization check — the reader role in Velociraptor was granted access to an API surface that was never designed for least-privilege enforcement. The SetPassword method, which modifies authentication state across the entire deployment, was accessible to any authenticated principal. The only gating was whether a user could log in at all, not whether that user should be permitted to reset passwords. The crash behavior when passing a non-existent username is the critical forensic artifact. The server terminates rather than returning a typed error because the code path assumes the user exists — it was written assuming only privileged actors (admins operating through the GUI or internal workflows) would invoke it. That implicit trust assumption predates the reader role entirely. When the role model was introduced, SetPassword wasn't deliberately added to the reader-accessible surface; it was never removed, because the role definition enumerated what admins could do rather than what readers couldn't. Any API method added without explicit capability-gating becomes reader-accessible by default under that model. For analysts, the immediate question is what other API methods have this same gap. The fix requires establishing whether the enforcement gap lives in role-to-permission mapping (the data layer) or in API routing (the control layer) — this distinction determines whether other endpoints have the same latent flaw. Check commit history: if SetPassword existed as admin-only and was made accessible later, that's your origin point. If it was added to the API surface in one commit without capability gating, the authorization model may have never covered it at all. The DoS vector compounds the risk. Terminating a forensic and incident response platform mid-investion blinds defenders, disables evidence collection pipelines, and breaks automated response workflows. The CVSS 6.5 score doesn't model this operational context. Treat this as higher priority than the severity label suggests — the exploit path is simple (any reader-account holder calls SetPassword with a non-existent username), and the disclosure window is now open.

Reviewed through automated stages and approved by a human before publication.