# CVE-2026-61708: SOCFortress CoPilot authorization bypass in data store upload

Source: https://junglewise.ai/threats/cve-2026-61708-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-61708 · Severity: high · CVSS 8.5 · Published 2026-10-30

SOCFortress CoPilot is a security operations platform that centralizes threat monitoring and case management across multiple tenants. Prior to version 0.1.76, a low-privilege customer user could upload files to any tenant's storage buckets without validation, allowing them to overwrite critical files such as endpoint telemetry configurations, case evidence, and forensic artifacts belonging to other organizations. This could enable data tampering, blind security monitoring, corrupt investigations, or plant malicious data across the platform.

Technologies: [SOCFortress CoPilot](https://junglewise.ai/threats/technologies/copilot). Vendors: [SOCFortress](https://junglewise.ai/threats/vendors/socfortress).

## Quick answers

**Is CVE-2026-61708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61708 being exploited in the wild.

**How severe is CVE-2026-61708?** High severity, with a CVSS score of 8.5, published 30 October 2026.

**Which products and versions are affected?** SOCFortress CoPilot prior to 0.1.76.

**Is there a fix for CVE-2026-61708?** Yes: fixed in 0.1.76. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61708 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61708?** Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.1.76

## Technical details

The POST /api/agent_data_store/upload endpoint permitted customer_user-role callers to specify arbitrary bucket_name and object_name parameters without allowlist validation, tenant prefix checks, or content restrictions. The backend automatically created missing buckets and performed upsert operations, enabling cross-tenant object overwrite attacks against sysmon configurations, case evidence, forensic artifacts, and report templates. The fix restricts the endpoint to admin/analyst roles only.

## Affected products

- SOCFortress CoPilot prior to 0.1.76

## Timeline

- 2026-10-30: disclosed: CVE-2026-61708 published

## References

- [https://github.com/socfortress/CoPilot/commit/2d090bc07a109eefbdf9ed22dc67b0c93922d9ca](https://github.com/socfortress/CoPilot/commit/2d090bc07a109eefbdf9ed22dc67b0c93922d9ca)
- [https://github.com/socfortress/CoPilot/pull/937](https://github.com/socfortress/CoPilot/pull/937)

## Related threats

- [SOCFortress CoPilot authorization bypass in Velociraptor Sigma exclusion endpoints](https://junglewise.ai/threats/cve-2026-61739-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot path traversal in ScoutSuite report upload](https://junglewise.ai/threats/cve-2026-61738-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot unauthenticated GCP credential and report exposure](https://junglewise.ai/threats/cve-2026-61730-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot hardcoded webhook secret authentication bypass](https://junglewise.ai/threats/cve-2026-61729-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot stored cross-site scripting in alerts and cases](https://junglewise.ai/threats/cve-2026-61728-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)