SysReptor CVE-2026-42291

The attacker must hold a valid authenticated session on the SysReptor instance (PR:L - any low-privileged user account suffices). Exploitation further requires prior knowledge of a target user's personal note ID, which is not directly exposed through standard navigation - the attacker must obtain it through out-of-band means such as social engineering, traffic observation, or ID enumeration. The flaw is limited to SysReptor Professional deployments with multiple user accounts where at least one user does not already have superuser privileges; Community edition deployments are unaffected in practice because superuser-equivalent access is universal. No specific non-default configuration, service, or protocol needs to be enabled beyond having the SysReptor application accessible over the network.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 6.8 (Medium), reflecting that an authenticated attacker with low privileges must first acquire a victim's note ID before exploiting the flaw - hence AC:H. EPSS at 0.02% (7th percentile) aligns with the absence of KEV listing and no known public exploit, suggesting no active in-the-wild exploitation. The SSVC assessment of Technical Impact: total is consistent with C:H/I:H in CVSS, but SSVC Automatable: no reinforces the AC:H signal - the prerequisite note-ID enumeration step prevents trivial mass exploitation. The combined picture is a medium-severity privilege escalation that is meaningful in SysReptor deployments where users hold confidential pentest data in personal notes, but presents low opportunistic risk. The Community edition caveat further reduces real-world scope; the highest-risk targets are Professional deployments with multiple untrusted users sharing the same instance.

An authenticated SysReptor Professional user on a shared instance enumerates or socially engineers a colleague's personal note ID - for example by observing it in a URL during a screen share or by brute-forcing a predictable ID namespace. The attacker then calls the note sharing link endpoint with the victim's note ID, creates a persistent sharing link, and gains full read/write access to the victim's pentest notes, which may contain client credentials, scope details, or unreported vulnerability findings. No public exploit code has been identified at the time of this analysis.