The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-61739: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-61739
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
Prior to version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints in backend/app/incidents/routes/incident_alert.py lack role and tenant authorization, and POST /api/incidents/alerts/create/velo-sigma/exclusion does not validate credentials. Because return_username_for_logging passes invalid, expired or forged token strings through instead of rejecting them, an attacker can create suppression rules that drop matching alerts before incident creation, including platform-wide rules when customer_code is null. Low-privilege customer_user accounts can also read, modify, disable or delete any exclusion.
Mitigation
Fixed in 0.1.77.