SysReptor
CVE-2026-44987
LOW
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
AC:H reflects two attacker-uncontrolled prerequisites - non-default Forgot Password enabled and Superuser MFA absent - beyond the already high PR:H requirement.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.
AnalysisAI
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts by exploiting an overly permissive email-change capability combined with the optional Forgot Password reset flow. When the 'Forgot Password' feature is enabled (non-default) and the targeted Superuser has no MFA configured, a User Admin can redirect the password reset token to an attacker-controlled address and authenticate as Superuser, gaining access to the Django backend (/admin) and full installation settings control. No public exploit exists and EPSS stands at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status, but the impact when conditions are met is significant for the affected SysReptor installation.
Technical ContextAI
SysReptor is a Python-based pentest reporting platform by Syslifters, identified by CPE cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*. The root cause maps to CWE-269 (Improper Privilege Management): the 'User Admin' role is granted write access to user account attributes - including email addresses - without restriction based on the target account's privilege level. This design flaw allows a lower-privileged role to manipulate the account recovery surface of a higher-privileged role. The attack chain depends on the interaction between the user management subsystem and the optional password-reset flow (Forgot Password), which when enabled relies solely on email delivery to verify identity. The vulnerability is further gated by the absence of MFA on the Superuser account, as MFA would interrupt the login step even after a successful password reset.
RemediationAI
Upgrade to SysReptor version 2026.29 or later, which implements multiple hardening measures per the release notes at https://github.com/Syslifters/sysreptor/releases/tag/2026.29; update instructions are available at https://docs.sysreptor.com/setup/updates/. If immediate upgrade is not possible, disable the 'Forgot Password' feature, which is already non-default and is the critical enabler of the full exploit chain - removing it closes the account-takeover path entirely with no functional impact on users who rely on administrator-driven account recovery. Additionally, enforce MFA on all Superuser accounts; MFA on the Superuser breaks the final authentication step even if a password reset is achieved, providing an independent compensating control. Restricting the 'User Admin' role from being assigned to untrusted personnel until patched is also advisable, as the role by design can also assign itself Project Admin permissions to access all pentest projects.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today