Read the docs
TI-2026-56077 Aliases CVE-2026-81179

SysReptor: Host header injection might allow account takeover

Priority LOW 38CWE-807Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Fixed sysreptor (Syslifters): 2026.58

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Syslifterssysreptorbefore 2026.582026.58Patch availableCNA
  • sysreptor VendorSyslifters Affected before 2026.58 Fixed in 2026.58 Patch available CNA

Remediation

  • Fix · CNA sysreptor (Syslifters) Fixed in 2026.58

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81179

References

Other 3

  • TI-2025-37333 SysReptor Susceptible to Privilege Escalation by Authenticated Users CVSS 3.1HIGH 8.1
  • TI-2026-56078 SysReptor: Authenticated RCE by insecure image processing CVSS 3.1HIGH 8.8
  • TI-2024-23926 Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30… CVSS 3.1HIGH 8.8
  • TI-2025-40972 SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
  • TI-2026-30602 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional CVSS 3.1MEDIUM 6.8
  • TI-2026-56080 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes CVSS 3.1MEDIUM 4.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences