EUVD-2026-83248Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
A public share-link holder needs no account (PR:N) and static member/note metadata leaks on connect without interaction (UI:N); impact is confidentiality-only and limited to metadata (C:L, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
AnalysisAI
Unauthenticated holders of a SysReptor public note share link can retrieve project-wide collaborative-editing metadata for any deployment running a version prior to 2026.55, because the public-share WebSocket consumer joins the same collaboration group as authenticated project members and forwards client-information, connect/disconnect, awareness, and deletion events without restricting them to the shared note subtree. This leaks project member usernames and display names plus the identifiers and live editing activity of notes that were never shared; note content itself stays protected and no write access is granted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires possession of a valid public note share link for a SysReptor project running a version prior to 2026.55; the public-share WebSocket consumer joins the same collaboration group as authenticated members and forwards client-info, connect/disconnect, awareness, and delete events without confining them to the shared note subtree. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-severity information-disclosure issue, and the multiple signals agree on that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SysReptor to 2026.55 or later - the vendor-released patch (commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1, release https://github.com/Syslifters/sysreptor/releases/tag/2026.55, advisory https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9c) empties the client-info list returned to public share consumers, drops CONNECT/DISCONNECT events, and forwards only a public client's own AWARENESS events. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated users of SysReptor Professional can turn a crafted image upload into arbitrary code execution: image forma
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privile
Password reset token disclosure in SysReptor prior to 2026.58 allows an unauthenticated attacker who knows a victim's em
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authentica
Insecure direct object reference (CWE-639) in SysReptor before 2026.68 lets a remote attacker holding a public read-writ
Privilege escalation in SysReptor prior to version 2026.29 allows authenticated User Admins to hijack Superuser accounts
Session fixation in the password-protected shared-notes flow of SysReptor (Syslifters) before version 2026.68 lets an at
SysReptor is a fully customizable pentest reporting platform. Rated high severity (CVSS 8.1), this vulnerability is remo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today