IT SBIT Services
Schneeberger
DEEN
CVE tracker

SOCFortress CoPilot: Stored XSS in alert comments and SOC fields

CVE-2026-61728Critical 9.9

← All vulnerabilities

Summary

SOCFortress CoPilot renders user-submitted alert comments and SOC case, asset and health-check fields as raw HTML in the portal. A portal user, including a customer_user, can store script code that runs in the browser of another user who views the affected item, such as an analyst or administrator. According to the CVE description, stolen tokens could enable account takeover and cross-tenant access; this token part is not confirmed by the commit excerpts. The CNA rates the issue CVSS 3.1 9.9 (Critical).

Affected

  • SOCFortress CoPilot versions before 0.1.76
  • Health-check field: according to the CVE description, affected before 0.1.70 (not independently verified)

Fixed in

  • Version 0.1.76 (provisional first release with the observed fixes, per the vendor commits and release notes)
  • Health-check field: 0.1.70 according to the CVE description (not independently verified)

Workaround

  • No vendor workaround known. Upgrade to 0.1.76 or a later release.
  • Until patched: restrict customer_user accounts and search stored comments and case fields for script or HTML content.

Exploitation

  • Not known to be exploited at the time of writing.
  • No public proof of concept found in the research; this does not rule one out.

Our recommendation

  • Upgrade CoPilot to 0.1.76 or a later release.
  • Limit portal accounts to trusted users and check stored comments and case fields for suspicious HTML or script content.
  • After patching, force re-login for analysts and administrators who viewed affected content and treat their sessions as potentially exposed.
  • Restrict portal access to the internal network where possible.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:21.

Original description (NVD)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without escaping or sanitizing HTML. When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`, `SocCaseAssetsItem.vue`, `SocAlertAssetsItem.vue` and `HealthcheckItem.vue`. The authentication store in `customer-portal/src/stores/auth.ts` persists both access and refresh tokens in JavaScript-readable storage, and `customer-portal/src/api/httpClient.ts` uses bearer headers rather than HttpOnly cookies. An injected script can steal both tokens, impersonate the viewer and obtain fresh tokens through `/auth/refresh`. If an analyst or administrator views the poisoned alert or case, this enables persistent privileged account takeover, cross-tenant data access, incident modification or deletion, and detection/response subversion. The health-check sink repair is first contained in version 0.1.70, while the comment and other SOC sink repairs are first contained in version 0.1.76. Version 0.1.76 is the provisional first release containing all observed repairs; grouped versus split CVE scope requires curator adjudication.

NVD references (6)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.