SysReptor
CVE-2026-42291
MEDIUM
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible IDOR requiring prior note-ID acquisition (AC:H), authenticated low-privilege user (PR:L), full read/write on victim notes (C:H/I:H), no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users' personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27.
AnalysisAI
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Technical ContextAI
SysReptor (CPE: cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*) is a Django-based pentest reporting platform. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a sub-class of IDOR where the application uses a user-supplied identifier - in this case a note ID - to locate a resource without verifying that the requesting user is authorized to access or manipulate it. Specifically, the REST or API endpoints governing the listing and creation of sharing links for personal notes (UserNotebookPage objects) fail to enforce ownership checks, allowing any authenticated user to substitute an arbitrary note ID belonging to another user. Because sharing link creation grants persistent read/write access to the underlying note object, exploitation does not require the attacker to maintain continuous access after the link is created.
RemediationAI
Upgrade SysReptor to version 2026.27, which contains the fix for personal note sharing permissions per the vendor's security advisory (https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43) and confirmed in the release notes at https://github.com/Syslifters/sysreptor/releases/tag/2026.27. Update instructions are available at https://docs.sysreptor.com/setup/updates/. If an immediate upgrade is not feasible for Professional deployments, restrict SysReptor instance access to a closed, fully trusted user set - since the attacker must be authenticated and must possess a victim's note ID, reducing the pool of authenticated users to only mutually trusted operators eliminates the threat surface. There is no documented per-feature toggle to disable note sharing endpoints as a standalone workaround; upgrade is the only confirmed fix.
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privile
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today