GHSA-gpw6-25f6-673mMediumCVSS 6.5
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on...
🔗 CVE IDs covered (1)
📋 Description
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.
Server metadata is often used to store site wide configuration data that should only be updated by the server admin.