Read the docs
TI-2026-32846 Aliases CVE-2026-44987

SysReptor: Privilege Escalation from User Admin to Superuser

Priority LOW 17CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed sysreptor (Syslifters): 2026.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Syslifterssysreptorbefore 2026.292026.29Patch availableCNA
  • sysreptor VendorSyslifters Affected before 2026.29 Fixed in 2026.29 Patch available CNA

Remediation

  • Fix · CNA sysreptor (Syslifters) Fixed in 2026.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44987

References

Other 2

  • TI-2025-37333 SysReptor Susceptible to Privilege Escalation by Authenticated Users CVSS 3.1HIGH 8.1
  • TI-2026-56078 SysReptor: Authenticated RCE by insecure image processing CVSS 3.1HIGH 8.8
  • TI-2024-23926 Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30… CVSS 3.1HIGH 8.8
  • TI-2026-56077 SysReptor: Host header injection might allow account takeover CVSS 3.1HIGH 8.1
  • TI-2025-40972 SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
  • TI-2026-30602 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional CVSS 3.1MEDIUM 6.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences