SysReptor CVE-2026-44987

Three specific conditions must all be true simultaneously: (1) the attacker must possess an authenticated 'User Admin' role within SysReptor (PR:H per CVSS); (2) the SysReptor installation must have the 'Forgot Password' feature explicitly enabled - this is a non-default configuration, meaning most deployments are not vulnerable to the account-takeover step; and (3) the targeted Superuser account must have no MFA configured, as MFA would block login even after a successful password reset. Exploitation is further limited by scope: the impact is confined to the SysReptor application itself and does not directly affect underlying host OS or other systems. The requirement for an already-privileged insider account (User Admin) significantly narrows the realistic threat population.

Real-world risk is low and highly conditional. The CVSS base score of 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) reflects the high privilege prerequisite correctly, though the vendor's AC:L assessment may understate the dependency on two out-of-attacker-control conditions: the non-default 'Forgot Password' feature being enabled, and the Superuser lacking MFA. EPSS at 0.02% (5th percentile) and SSVC designation of 'Exploitation: none, Automatable: no, Technical Impact: partial' all reinforce that this is a theoretical risk vector rather than an actively exploited one. The CVSS-implied low C:L/I:L impact is somewhat inconsistent with the actual outcome of a successful attack chain - full Superuser access including Django admin backend - but the score accounts for the high privilege bar. No active exploitation is confirmed; no public exploit code is identified. Defenders should prioritize this primarily in environments that have enabled Forgot Password and have Superusers without MFA.

An attacker who already holds a 'User Admin' account - for example, a malicious insider or a compromised staff account - navigates to the user management panel, locates a Superuser account, and changes its registered email to an address they control. The attacker then initiates a Forgot Password request for that Superuser account; the reset link is delivered to the attacker's inbox. They follow the link to set a new password and log in as Superuser, gaining access to the Django /admin backend and the ability to manipulate SysReptor installation settings. No public exploit code is known at time of analysis.