Read the docs
TI-2026-30602 Aliases CVE-2026-42291

SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users' personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00188 8th percentileScored 2026-11-07
Fix Fixed sysreptor (Syslifters): 2026.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Syslifterssysreptor2026.4 to before 2026.272026.27Patch availableCNA
  • sysreptor VendorSyslifters Affected 2026.4 to before 2026.27 Fixed in 2026.27 Patch available CNA

Remediation

  • Fix · CNA sysreptor (Syslifters) Fixed in 2026.27

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42291

References

Other 2

  • TI-2025-37333 SysReptor Susceptible to Privilege Escalation by Authenticated Users CVSS 3.1HIGH 8.1
  • TI-2026-56078 SysReptor: Authenticated RCE by insecure image processing CVSS 3.1HIGH 8.8
  • TI-2024-23926 Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30… CVSS 3.1HIGH 8.8
  • TI-2026-56077 SysReptor: Host header injection might allow account takeover CVSS 3.1HIGH 8.1
  • TI-2025-40972 SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
  • TI-2026-56080 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes CVSS 3.1MEDIUM 4.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences