---
id: "CVE-2026-61739"
kind: "vulnerability"
aliases: ["CVE-2026-61739"]
title: "SOCFortress CoPilot: forged token can suppress security detections platform-wide"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "sigma", "socfortress-copilot", "velociraptor"]
not_affected_if: ["version-0.1.77-or-later"]
published_at: "2026-10-30T15:16:53+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61739", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# SOCFortress CoPilot: forged token can suppress security detections platform-wide

Before version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints accept invalid, expired or forged Bearer tokens, so an attacker can create suppression rules without an account. Those rules can silently drop matching security alerts across all tenants, and low-privilege users can read, change or delete existing exclusions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CoPilot version; affected builds are anything below `0.1.77`.
- Look in `backend/app/auth/utils.py` for `return_username_for_logging` passing through `decode_token` error strings instead of rejecting the request.
- Review existing Velociraptor Sigma exclusions for rules with a null `customer_code`, which apply across all tenants.

## Fix

- SOCFortress CoPilot: upgrade to `0.1.77`

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61739

## From the sources

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_