CVE-2026-61708

In SOCFortress CoPilot prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints omit role and tenant authorization, and the exclusion creation endpoint does not properly validate credentials — any invalid, expired or forged Bearer token can create a suppression rule. Additionally, rules with a null customer_code apply across all tenants, and low-privilege users can list, modify, disable or delete exclusions.

In SOCFortress CoPilot prior to 0.1.77, the POST /api/scoutsuite/generate-gcp-report endpoint passes the raw multipart filename to the file writer without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory, including into the application source directory.

In SOCFortress CoPilot, the unauthenticated /scoutsuite-report StaticFiles mount exposes the scoutsuite-report directory, disclosing HTML reports and result files containing AWS, Azure and GCP IAM principals, resource inventories and misconfigurations. During a GCP scan, the service-account key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it.

In SOCFortress CoPilot prior to 0.1.76, verify_graylog_header and verify_velociraptor_header authenticate webhooks against the same publicly hardcoded fallback header, also shipped in .env.example. Deployments with unchanged secrets let an anonymous caller bypass JWT authentication, invoke active-response actions and create forged alerts.

In SOCFortress CoPilot, portal users including customer_user accounts can submit stored markup via the alert comment endpoint, which is rendered without sanitization using v-html. This enables stored XSS, and because access and refresh tokens are persisted in JavaScript-readable storage, injected script can steal them and impersonate the viewer. The same unsanitized rendering affects other SOC fields (cases, assets, health-checks), with fixes first contained in versions 0.1.70 (health-check) and 0.1.76 (comments and other SOC sinks).

In SOCFortress CoPilot prior to 0.1.76, case-report templates uploaded by the lowest-privilege customer_user role are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. Lack of template content validation and cross-tenant scoping allows an attacker to inject malicious Jinja expressions that are evaluated as Python on the backend.

In versions prior to 0.1.57, SOCFortress CoPilot contained a hardcoded JWT signing secret, allowing attackers to forge admin-scoped tokens. If JWT_SECRET is not set, all authentication tokens are signed with this publicly known key.