CVE-2026-81178
LowCVSS 3.5Summary
SysReptor prior to 2026.55 discloses project-wide collaborative editing metadata to an unauthenticated holder of a public note share link. The metadata can reveal usernames, note identifiers, and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access.
Risk Assessment
Metadata disclosure can leak information about project members and note structure, which may be used for further social engineering attacks. Unauthorized access to metadata can breach confidentiality.
Recommendation
Update SysReptor to version 2026.55 or later. Review public note share links and restrict their use to the necessary minimum.
Other vulnerabilities in SysReptor
See all- CVE-2026-81182Medium
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
- CVE-2026-81181Low
SysReptor prior to 2026.68 does not rotate the session identifier after successful password authentication for protected shared notes, allowing session fixation. An attacker can reuse the fixed session after the victim authenticates to the shared note. The main SysReptor login flow is not affected.
- CVE-2026-81180High
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory.
- CVE-2026-81179High
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token.
- CVE-2026-44987Low
In SysReptor before version 2026.29, users with "User Admin" permissions can change email addresses of "Superuser" users. If "Forgot Password" is enabled, they can reset the superuser's password and access the Django backend and manipulate settings.
Original NVD description (English source)
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.