CVE-2026-81182 in SysReptor
Summary
by MITRE • 09/18/2026
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
SysReptor operates as a comprehensive pentest reporting platform designed to facilitate the creation of customizable security assessment reports for penetration testing engagements. Within this ecosystem, users can create shared notes that are accessible via public read-write links, allowing collaborators or clients to view and edit specific sections of a report without requiring full authentication. This functionality is intended to streamline communication during active assessments but introduces complex authorization boundaries when interacting with other resources within the same project context.
A critical vulnerability exists in the access control logic governing these shared notes prior version 2026.68. The flaw stems from an improper restriction of unauthorized resource access, specifically categorized under CWE-284 Improper Access Control. An attacker who possesses a valid public read-write link to a specific note can manipulate the content of that note by updating it to include references or links pointing to assets uploaded within the same project. These assets typically include sensitive documents such as vulnerability findings, network diagrams, or credential lists stored in the platform's file repository.
The technical mechanism of exploitation relies on how the application validates permissions for asset retrieval. When a user requests access to an asset through the shared note interface, the system checks whether the current session has permission to view that specific resource. Due to the logic flaw, if the attacker modifies the shared note to reference a target asset filename, the authorization module incorrectly interprets this action as implicit approval or contextual relevance. Consequently, the application treats the referenced asset as permitted for access by the user holding the share link, bypassing standard authentication checks required for direct file downloads.
This vulnerability allows an unauthenticated attacker who knows the exact filename of a target asset to disclose its contents. The operational impact is significant in scenarios where sensitive data such as internal IP addresses, discovered vulnerabilities with proof-of-concept details, or confidential client information are stored within project assets. By downloading these files, the attacker gains unauthorized access to proprietary security assessment results which could be leveraged for further attacks against the target organization. It is important to note that this vulnerability does not permit cross-project access; the scope of exploitation is strictly limited to assets residing within the same project as the compromised shared note.
The attack vector aligns with ATT&CK technique T1078 Valid Accounts, specifically in contexts where valid but overly permissive sharing links are misused to escalate privileges or bypass restrictions. While the attacker does not hold a traditional user account, they exploit a validly issued token (the share link) beyond its intended scope of use. This represents a form of privilege escalation through logical flaws rather than technical exploitation of code execution vulnerabilities.
Mitigation for this issue involves upgrading SysReptor to version 2026.68 or later, where the authorization logic has been corrected to strictly validate access permissions independent of note content references. Organizations currently using earlier versions should immediately revoke any public read-write share links associated with sensitive projects until an upgrade can be performed. Additionally, administrators should audit existing shared notes for any embedded links that might reference internal assets and ensure that file sharing mechanisms enforce strict separation between document viewing rights and asset download permissions. Implementing additional validation layers to verify the relationship between the requesting context and the target resource before granting access is recommended as a defense-in-depth measure against similar logical flaws in future developments.