Authorization Flaw in SOCFortress CoPilot Security Operations Platform

CVE-2026-61739

What is CVE-2026-61739?

SOCFortress CoPilot contains an authorization flaw that allows attackers to create suppression rules without valid credentials due to missing role checks in the exclusion-management endpoints. Specifically, the application permits authenticated users to manipulate exclusion data unchecked, leading to potential suppression of alerts across multiple tenants. This flaw arises from improper credential validation and the handling of tokens, enabling low-privilege accounts to enumerate and manage exclusion rules. Mitigation measures were introduced in version 0.1.77, addressing these critical security issues.

References