SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Goog
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Socfortress
- Product
- CoPilot
- CVSS v3.1
- 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
- Exploitation
- SSVC none, automatable yes, impact partial
- Weakness
- CWE-200, CWE-306, CWE-522
- NVD status
- Received
Why it ranks 28 (Notable)
- CVSS v3.1 9.3 critical
- SSVC: automatable
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-61730 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.