CVE-2026-61708

SOCFortress CoPilot versions prior to 0.1.76 are vulnerable to a cross-tenant arbitrary object-store write via the POST /api/agent_data_store/upload endpoint in backend/app/data_store/data_store_routes.py. The root cause is a lack of allowlists, tenant prefixes, ownership checks, or content restr...