CVE-2026-61730

The SOCFortress CoPilot application suffers from an unauthenticated exposure of sensitive data via a static mount in backend/copilot.py. The /scoutsuite-report endpoint lacks the JWT authentication required by other routes, exposing the scoutsuite-report directory. This allows anonymous clients t...

CVE-2026-61730 SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT...