{"id":"CVE-2026-61739","aliases":[],"cve":{"records":[{"id":"CVE-2026-61739","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T18:59:00.047Z","published":"2026-10-30T14:50:23.292Z","modified":"2026-10-30T15:45:17.745Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T14:50:23.292Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T15:45:17.745Z"}],"references":[{"url":"https://github.com/socfortress/CoPilot/security/advisories/GHSA-c6jc-rh4j-wg88","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/socfortress/CoPilot/pull/942","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/socfortress/CoPilot/commit/d22f80f9086ef5e68baa3a9414bff7d7621a14a8","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/socfortress/CoPilot/tree/v0.1.77","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/socfortress/CoPilot/security/advisories/GHSA-c6jc-rh4j-wg88","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-287","description":"CWE-287: Improper Authentication","source":"GitHub_M"},{"id":"CWE-862","description":"CWE-862: Missing Authorization","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:44:53.572533Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.","score":7.5,"severity":"high","published":"2026-10-30T14:50:23.292Z","modified":"2026-10-30T15:45:17.745Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"socfortress","name":"CoPilot","platforms":[],"versions":[{"version":"< 0.1.77","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61739"}],"remediation":[],"references":["https://github.com/socfortress/CoPilot/security/advisories/GHSA-c6jc-rh4j-wg88","https://github.com/socfortress/CoPilot/pull/942","https://github.com/socfortress/CoPilot/commit/d22f80f9086ef5e68baa3a9414bff7d7621a14a8","https://github.com/socfortress/CoPilot/tree/v0.1.77"],"sources":[{"name":"CVE","id":"CVE-2026-61739","modified":"2026-10-30T15:45:17.745Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61739"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T16:18:17.538Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:20:32.721Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T16:30:36.445Z","attemptedAt":"2026-10-30T16:30:36.445Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T16:30:36.796Z","attemptedAt":"2026-10-30T16:30:36.796Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T16:30:36.477Z","attemptedAt":"2026-10-30T16:30:36.477Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T16:30:35.776Z","attemptedAt":"2026-10-30T16:30:35.776Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-61739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61739","modified":"2026-10-30T16:17:58.080","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T16:30:36.445Z"},{"source":"ENISA EUVD","id":"EUVD-2026-114005","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114005","modified":"Oct 30, 2026, 2:50:23 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T16:30:36.477Z"}],"aiSummary":null}