CVE-2026-81179 in SysReptor
Summary
by MITRE • 09/18/2026
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
SysReptor operates as a comprehensive pentest reporting platform designed to streamline the documentation of security assessments. A critical vulnerability exists within versions prior to 2026.58, specifically affecting installations that utilize wildcard configurations for ALLOWED_HOSTS while enabling password reset functionality via email. This configuration flaw allows an unauthenticated attacker to manipulate the Host header during a password reset request. When the application generates the password reset link, it incorporates this manipulated Host value into the URL structure rather than validating or sanitizing it against a strict allowlist of trusted domains.
The technical core of this vulnerability lies in improper validation of HTTP headers used for constructing absolute URLs. By sending a maliciously crafted Host header, an attacker can force the application to generate a password reset link that points to a domain under their control instead of the legitimate SysReptor instance. This behavior is characteristic of Server-Side Request Forgery (SSRF) variants or more specifically Insecure Direct Object Reference in URL generation contexts where host validation is lax. The vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the token leakage leads to account takeover, though it primarily falls under CWE-613 Insufficient Session Expiration or CWE-434 Unrestricted File Upload in broader terms of trust boundary violations. In the MITRE ATT&CK framework, this technique relates to T1078 Valid Accounts and potentially T1592 Gather Victim Host Information depending on how much infrastructure detail is leaked through the redirect mechanism.
The operational impact of this vulnerability is severe as it facilitates complete account takeover without requiring prior authentication credentials from the attacker. Once an unauthenticated user triggers a password reset for a target victim, they receive control over the generated link's destination. When the victim receives the email and clicks the provided link to set their new password, the request is directed to the attacker-controlled server. This action causes the application to transmit the sensitive one-time password token or session data back to the attacker in plain text via HTTP headers or query parameters during the redirect process. With possession of this reset token, the attacker can subsequently access the legitimate login endpoint and complete the password change procedure, thereby gaining full administrative or user-level access to the victim's SysReptor account.
Exploitation prerequisites include a functioning email gateway capable of delivering messages to the target and knowledge of at least one valid email address associated with an existing account on the platform. Additionally, the success rate may be influenced by intermediate network security controls; some reverse proxy configurations or web application firewalls might reject requests containing suspicious Host headers before they reach the application server, thereby mitigating the risk in certain environments. However, where such protections are absent or misconfigured, particularly with wildcard ALLOWED_HOSTS settings intended for development or flexible deployment scenarios, the attack vector remains fully viable.
Mitigation strategies involve upgrading to version 2026.58 which addresses this logic flaw by enforcing strict validation of host values during URL generation. Administrators should ensure that ALLOWED_HOSTS is configured with explicit domain names rather than wildcards where possible to reduce the surface area for header injection attacks. Furthermore, implementing security headers such as Strict-Transport-Security and configuring reverse proxies to sanitize or reject malformed Host headers can provide defense-in-depth measures against this type of abuse until patches are applied. Regular auditing of email link generation logic is recommended to prevent similar vulnerabilities in other web applications that rely on dynamic URL construction based on incoming request metadata.