Insecure Direct Object Reference in SOCFortress CoPilot

CVE-2026-61708

What is CVE-2026-61708?

The SOCFortress CoPilot application suffers from an insecure direct object reference vulnerability. In versions prior to 0.1.76, the API endpoint POST /api/agent_data_store/upload fails to enforce crucial security checks, allowing unauthorized user access to specify bucket_name and object_name for file uploads without any proper validation or ownership verification. Consequently, this oversight can lead to data tampering, unauthorized overwrites of existing tenant objects, and potential exposure of sensitive files across different tenants. The vulnerability can be exploited by a low-privileged user, enabling them to disrupt endpoint telemetry, manipulate reporting templates, and inject malicious content or exhaust storage resources. The issue has been addressed in version 0.1.76, reinforcing the security integrity of the system.

References