CVE-2026-61708 SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agentdatastore/upload in backend/app/datastore/datastoreroutes.py permits customeruser callers to choose bucketname and objectname without an allowlist, tenant prefix...

CVE-2026-61708

SOCFortress CoPilot versions prior to 0.1.76 are vulnerable to a cross-tenant arbitrary object-store write via the POST /api/agent_data_store/upload endpoint in backend/app/data_store/data_store_routes.py. The root cause is a lack of allowlists, tenant prefixes, ownership checks, or content restr...