CVE-2026-61739— SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)

Quick assessment

Affected

socfortress CoPilot

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化界面。在 0.1.77 版本之前，中的 Velociraptor Sigma 排除管理端点未实施角色和租户授权检查，且接口未验证凭据。该接口依赖的（位于）会调用，而当令牌无效或签名过期时，仅返回普通错误字符串（如 "Invalid token" 或 "Expired signature"），依赖函数却将这些字符串直接透传，而非拒绝请求。虽然该接口要求提供 Bearer 令牌，但攻击者可使用任意无效、过期或伪造的令牌值，在无需有

CVSS 7.5 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1133 · External Remote Services T1562.006

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)

Source: CVE Program / CVE List V5

Vulnerability Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
socfortress	CoPilot	< 0.1.77	-

II. Public POCs for CVE-2026-61739

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61739

请登录查看更多情报信息。

Other References for CVE-2026-61739 (4)

https://github.com/socfortress/CoPilot/pull/942 x_refsource_MISC
https://github.com/socfortress/CoPilot/tree/v0.1.77 x_refsource_MISC
https://github.com/socfortress/CoPilot/security/advisories/GHSA-c6jc-rh4j-wg88 x_refsource_CONFIRM
https://github.com/socfortress/CoPilot/commit/d22f80f9086ef5e68baa3a9414bff7d7621a14a8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61739

Same Patch Batch · socfortress · 2026-10-30 · 6 CVEs total

CVE-2026-61738	10.0 CRITICAL	SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuit
CVE-2026-61728	9.9 CRITICAL	SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61729	9.4 CRITICAL	SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Inv
CVE-2026-61730	9.3 CRITICAL	SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Servi
CVE-2026-61708	8.5 HIGH	SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload E

IV. Related Vulnerabilities

Same product: CoPilot

Same vendor: socfortress

Same weakness: CWE-287