Read the docs
TI-2026-56079 Aliases CVE-2026-81181

SysReptor: Session Fixation in Password-Protected Shared Notes

Priority LOW 17CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-384.

Summary

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed sysreptor (Syslifters): 2026.68

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Syslifterssysreptorbefore 2026.682026.68Patch availableCNA
  • sysreptor VendorSyslifters Affected before 2026.68 Fixed in 2026.68 Patch available CNA

Remediation

  • Fix · CNA sysreptor (Syslifters) Fixed in 2026.68

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81181

References

Other 3

  • TI-2025-37333 SysReptor Susceptible to Privilege Escalation by Authenticated Users CVSS 3.1HIGH 8.1
  • TI-2026-56078 SysReptor: Authenticated RCE by insecure image processing CVSS 3.1HIGH 8.8
  • TI-2024-23926 Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30… CVSS 3.1HIGH 8.8
  • TI-2026-56077 SysReptor: Host header injection might allow account takeover CVSS 3.1HIGH 8.1
  • TI-2025-40972 SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
  • TI-2026-30602 SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional CVSS 3.1MEDIUM 6.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences