SOCFortress CoPilot CVE-2026-61728：儲存式 XSS 允許特權帳戶接管，已於 0.1.76 版修復
CVE-2026-61728 - SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
導語: SOCFortress CoPilot 0.1.76 版已修復 CVE-2026-61728 儲存式 XSS 與令牌竊取漏洞，該漏洞允許攻擊者在未經授權的情況下取得管理許可權。
此漏洞允許攻擊者利用儲存式 XSS 竊取令牌，進而取得管理許可權，提示使用者即時升級至 0.1.76 並已發布修補程式以阻斷此風險。
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without escaping or sanitizing HTML. When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`, `SocCaseAssetsItem.vue`, `SocAlertAssetsItem.vue` and `HealthcheckItem.vue`. The authentication store in `customer-portal/src/stores/auth.ts` persists both access and refresh tokens in JavaScript-readable storage, and `customer-portal/src/api/httpClient.ts` uses bearer headers rather than HttpOnly cookies. An injected script can steal both tokens, impersonate the viewer and obtain fresh tokens through `/auth/refresh`. If an analyst or administrator views the poisoned alert or case, this enables persistent privileged account takeover, cross-tenant data access, incident modification or deletion, and detection/response subversion. The health-check sink repair is first contained in version 0.1.70, while the comment and other SOC sink repairs are first contained in version 0.1.76. Version 0.1.76 is the provisional first release containing all observed repairs; grouped versus split CVE scope requires curator adjudication.
Impact
Affected Products
The following products are affected by CVE-2026-61728
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | MITRE-CVE | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Update to version 0.1.76 to fix stored XSS and token theft vulnerabilities.
- Update to version 0.1.76.
- Sanitize user-provided HTML input.
- Avoid storing tokens in JavaScript-readable storage.
- Use HttpOnly cookies for token management.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-61728.
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-61728 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-61728
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-61728 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-61728 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
十月. 30, 2026
Action Type Old Value New Value Added Description SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without escaping or sanitizing HTML. When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`, `SocCaseAssetsItem.vue`, `SocAlertAssetsItem.vue` and `HealthcheckItem.vue`. The authentication store in `customer-portal/src/stores/auth.ts` persists both access and refresh tokens in JavaScript-readable storage, and `customer-portal/src/api/httpClient.ts` uses bearer headers rather than HttpOnly cookies. An injected script can steal both tokens, impersonate the viewer and obtain fresh tokens through `/auth/refresh`. If an analyst or administrator views the poisoned alert or case, this enables persistent privileged account takeover, cross-tenant data access, incident modification or deletion, and detection/response subversion. The health-check sink repair is first contained in version 0.1.70, while the comment and other SOC sink repairs are first contained in version 0.1.76. Version 0.1.76 is the provisional first release containing all observed repairs; grouped versus split CVE scope requires curator adjudication. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-79 Added CWE CWE-922 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/61xxx/CVE-2026-61728.json">CVE-2026-61728</a> Added Reference https://github.com/socfortress/CoPilot/commit/461e8f84794aee8ada588de3bad79430dc9f4f3d Added Reference https://github.com/socfortress/CoPilot/commit/ab9078bdee5d1c737f37f481103984665a670bdd Added Reference https://github.com/socfortress/CoPilot/pull/904 Added Reference https://github.com/socfortress/CoPilot/pull/938 Added Reference https://github.com/socfortress/CoPilot/security/advisories/GHSA-8hqj-cqcc-5f6w Added Reference https://github.com/socfortress/CoPilot/tree/v0.1.76
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.