CVE-2026-81178 in SysReptor
Summary
by MITRE • 09/18/2026
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within SysReptor prior to version 2026.55 represents a significant flaw in the application's collaborative architecture, specifically concerning how public sharing mechanisms interact with real-time collaboration groups. The core technical issue stems from an improper isolation of user sessions and event scopes during the note-sharing process. When an unauthenticated user accesses a publicly shared note via its unique link, the system incorrectly assigns this session to the same WebSocket-based collaboration group as authenticated project members. This architectural oversight means that the client application joins a global or project-wide communication channel rather than being restricted to a scoped context limited strictly to the specific notes designated for public viewing. Consequently, the unauthenticated client begins receiving broadcast events intended exclusively for authorized participants within the private workspace environment.
This misconfiguration results in an information disclosure vulnerability where sensitive metadata is leaked to unauthorized parties. The system forwards various types of real-time events, including connection status updates, awareness signals indicating which users are currently active, and deletion notifications. Because these events are not filtered based on note ownership or sharing permissions, the unauthenticated holder can observe usernames and display names of project members who are online or interacting with the platform. Furthermore, the leakage extends to operational metadata regarding notes that were never intended for public access. The attacker gains visibility into the identifiers and live editing activity of private notes, effectively mapping out the structure and current workflow of a potentially sensitive pentest report without possessing any credentials or explicit permission to view those specific documents.
The impact of this vulnerability is primarily informational rather than destructive in terms of data integrity or confidentiality of content. While the actual text content of non-shared notes remains encrypted and protected from direct reading, the exposure of metadata poses substantial privacy and operational security risks for organizations using SysReptor. The ability to identify specific team members by name allows an attacker to correlate online presence with internal roles or responsibilities. Additionally, observing which private notes are being actively edited can reveal ongoing investigation topics, critical findings under review, or strategic directions of the penetration test engagement before they are formally reported. This level of reconnaissance aids adversaries in understanding the scope and progress of security assessments without triggering standard access control alerts associated with direct file access attempts.
From a classification perspective, this flaw aligns closely with CWE-201: Information Exposure Through Sent Data, as sensitive information is inadvertently transmitted to an unauthorized actor through system-generated events rather than stored directly in accessible files. It also relates to CWE-862: Missing Authorization, specifically regarding the failure to enforce access control on collaborative session management and event routing logic. In terms of offensive security frameworks, this behavior facilitates reconnaissance activities categorized under ATT&CK technique T1074: Data Staged or Local Data Collection, as it allows an external actor to gather intelligence about internal operations and personnel through passive observation of system communications rather than active exploitation of code execution flaws.
The resolution for this vulnerability involves implementing strict scoping rules within the collaboration engine to ensure that public share sessions are isolated from private project groups. The fix ensures that clients accessing notes via public links only subscribe to events relevant to those specific shared resources, thereby preventing the leakage of awareness data and member identities associated with non-shared content. Organizations running versions prior to 2026.55 should prioritize upgrading immediately to mitigate this information leak. Until the update is applied, administrators may consider restricting public sharing capabilities or implementing network-level access controls if feasible, although software patching remains the definitive remediation strategy for correcting the underlying architectural logic error in session management and event filtering.