Reconmap EUVD-2026-63900

The vulnerable PreviewReport endpoint (GET /reports/{id}/preview) must be present in the deployed codebase, meaning the fix commit 2b2eb0cf must not have been applied. No authentication, project membership, or role assignment is required - the [AllowAnonymous] attribute bypasses all policy checks. The Reconmap API must be network-reachable by the attacker; internet-facing deployments have no additional barriers. Sequential integer project IDs serve as the enumeration oracle; 404 responses for absent IDs aid complete enumeration but are not strictly required. Exploitation is limited solely to Reconmap instances; no lateral movement beyond the project and organisation data returned by the endpoint is possible through this vector alone.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N is consistent with the description: network-accessible, no authentication, no special conditions, confidentiality-only impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability has not been added to CISA KEV, and no public exploit code has been identified, meaning exploitation status is 'no public exploit identified at time of analysis.' However, the attack does not require exploit code - sequential HTTP GETs are sufficient - so the practical exploitation barrier is very low and the attack is automatable. The data sensitivity amplifies real-world risk significantly: Reconmap stores penetration-testing engagements, so exposed records may include target system inventories, client business relationships, and engagement scopes that are commercially and operationally sensitive. Organizations running internet-facing Reconmap instances should treat this as a high-priority remediation regardless of the absence of KEV or EPSS data.

An unauthenticated attacker iterates GET /api/reports/1/preview, /api/reports/2/preview, and so on against an internet-facing Reconmap instance; each 200 response returns an HTML page with the project name, description, and client organisation's name, address, and URL, while 404 responses confirm the absence of a given project ID. With a simple script - no credentials, no exploit code, no special tooling - the attacker harvests the complete list of penetration-testing engagements and client records, potentially exposing target identities, engagement scope, and business relationships of all clients on the instance.