Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61708— SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)

Quick assessment

Affected
socfortress CoPilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化界面。在 0.1.76 版本之前， 中的 接口允许 角色调用者在未实施白名单、租户前缀验证、所有权检查或内容限制的情况下，任意指定 （存储桶名称）和 （对象名称）。该接口唯一的文件校验仅要求文件名非空。 中的操作会创建缺失的存储桶并执行“插入或更新”（upsert）操作，导致任何租户的现有对象均可被覆盖。受影响的目标包括： 分发给受管 Windows 终端的 ； 服务端渲染的 报告模板； 位于 的案件证据或取证数据； 位于 的 Veloc

CVSS 8.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61708

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
Source: CVE Program / CVE List V5
Vulnerability Description
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers to choose `bucket_name` and `object_name` without an allowlist, tenant prefix, ownership check or content restriction. The only file check requires a nonempty filename. The operations in `backend/app/data_store/data_store_operations.py` create missing buckets and upsert objects, allowing existing objects belonging to any tenant to be overwritten. Targets include `sysmon-configs/<customer_code>/sysmon_config.xml` distributed to managed Windows endpoints, `copilot-case-report-templates/<name>` rendered server-side, and case evidence or forensic artifacts under `copilot-cases/<case_id>/<file>` and `velociraptor-artifacts/<agent_id>/<flow_id>/<file>`. A lowest-privilege user can tamper with cross-tenant evidence, blind endpoint telemetry, poison report templates for later code execution, plant data or exhaust storage. Sibling list, download and delete routes remain restricted to admin/analyst; the exposed operation is the upload write path. This issue is fixed in version 0.1.76.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
socfortress CoPilot < 0.1.76 -

II. Public POCs for CVE-2026-61708

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61708

请登录查看更多情报信息。

Vendor Pages for CVE-2026-61708 (1)

Other References for CVE-2026-61708 (3)

Same Patch Batch · socfortress · 2026-10-30 · 6 CVEs total

CVE-2026-61738 10.0 CRITICAL SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuit
CVE-2026-61728 9.9 CRITICAL SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61729 9.4 CRITICAL SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Inv
CVE-2026-61730 9.3 CRITICAL SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Servi
CVE-2026-61739 7.5 HIGH SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma

IV. Related Vulnerabilities

Same product: CoPilot
Same vendor: socfortress
Same weakness: CWE-284