SOCFortress CoPilot CVE-2026-61739

For the unauthenticated create: the target must run SOCFortress CoPilot prior to 0.1.77 with the backend API (e.g. ghcr.io/socfortress/copilot-backend) network-reachable; the attacker must include any Authorization: Bearer header (any invalid, expired or forged value suffices, because OAuth2PasswordBearer auto_error=True requires only header presence and decode_token never raises) - no valid account is needed. Setting customer_code=null makes the rule apply across all tenants. The suppression only has effect where the deployment actually ingests Velociraptor Sigma alerts via process_sigma_alert, and a rule only drops alerts that match its channel/title/field criteria, so impact depends on the attacker crafting a match for the activity they want hidden. The separate read/list/update/delete/toggle tampering path is limited by requiring a valid authenticated token (any role down to customer_user via get_current_user), but with no role or tenant restriction.

This is a genuine authorization/authentication-bypass issue (CWE-287 plus CWE-862 per the GHSA), not a severity-inflated finding. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) is internally consistent with the source evidence: the create endpoint is reachable over the network with no valid credentials because OAuth2PasswordBearer only enforces that an Authorization: Bearer header is present, while decode_token returns the sentinel strings 'Invalid token'/'Expired signature' instead of raising, and return_username_for_logging passes them through - so PR:N and AC:L are justified and the impact is squarely integrity (detection-suppression rules created/modified/deleted). No KEV entry and no EPSS score are present in the input, so there is no quantitative exploitation-probability or confirmed-in-the-wild signal to weigh; the vuln.today Decision label is 'this_week', below act_now/emergency. Against that, the GHSA advisory publishes a concrete two-request proof-of-concept with observed server output (created_by='Invalid token'), so exploitability is demonstrated even though active exploitation is not confirmed. The principal signals therefore agree on a real, promptly-actionable defense-evasion weakness in a security product, tempered only by the product's limited deployment footprint. Note one nuance the NVD vector flattens: the fully-unauthenticated path is the create endpoint (pure integrity), whereas the confidentiality exposure (enumerating detection-tuning data) and the cross-tenant global suppression via a null customer_code require an authenticated low-privilege customer_user - the NVD vector's C:N reflects the unauth attack, not the auth-gated information leak.

An attacker with only network reachability to the CoPilot API sends a single POST to /api/incidents/alerts/create/velo-sigma/exclusion carrying any arbitrary Bearer header, creating a suppression rule with customer_code=null that matches their own tooling by channel, title or field regex; subsequent Velociraptor Sigma alerts for that activity are silently dropped before incident creation across every tenant. The GHSA advisory includes a working proof-of-concept demonstrating exactly this with two curl requests and the server's response showing created_by='Invalid token'. A low-privilege customer_user can additionally enumerate, modify, toggle or delete legitimate exclusion rules.