CVE-2025-59945: Sysreptor Privilege Escalation Vulnerability

CVE-2025-59945 Overview

CVE-2025-59945 is a privilege escalation vulnerability in SysReptor, a customizable pentest reporting platform developed by Syslifters. Authenticated, non-admin users can assign themselves the is_project_admin permission through the user serializer. This grants unauthorized read, modify, and delete access to pentesting projects they are not members of. The flaw affects SysReptor versions from 2024.74 up to versions before 2025.83. The vendor patched the issue in version 2025.83. The vulnerability is classified under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Authenticated low-privilege users can elevate to project administrator and access confidential pentest reports, client data, and project artifacts across the entire SysReptor instance.

Affected Products

Syslifters SysReptor 2024.74 through versions before 2025.83
Self-hosted SysReptor deployments running affected versions
Cloud-hosted SysReptor instances not updated to 2025.83

Discovery Timeline

2025-09-27 - CVE-2025-59945 published to NVD
2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-59945

Vulnerability Analysis

The vulnerability resides in the user serializer logic at api/src/sysreptor/users/serializers.py. The serializer defines which user attributes can be modified by which role. SysReptor enforced read-only restrictions on sensitive permission flags such as is_superuser, is_user_manager, is_designer, is_template_editor, and is_guest for non-administrative users. However, the is_project_admin flag was missing from this read-only enforcement list. As a result, any authenticated user could submit an API request modifying their own user record and set is_project_admin to true. Once elevated, the attacker inherits project administrator authority across the entire instance, bypassing project membership controls.

Root Cause

The root cause is a missing access control entry in the user serializer field definitions. The serializer applied a read_only constraint to most privilege flags based on whether the requesting user was an administrator, but omitted is_project_admin from this enforcement. This is a classic incorrect privilege assignment flaw [CWE-266] where the authorization model fails to cover all sensitive attributes.

Attack Vector

An attacker requires only valid authenticated credentials with no special privileges. They issue an authenticated HTTP PATCH or PUT request to the user self-update API endpoint with a payload containing is_project_admin: true. The server accepts the modification because the field lacks read-only enforcement. After the change persists, the attacker can enumerate and access any project in the SysReptor tenant, including projects belonging to other teams or clients.

python

             'is_superuser': {'read_only': not getattr(user, 'is_admin', False)},
             'is_user_manager': {'read_only': read_only},
             'is_designer': {'read_only': read_only},
+            'is_project_admin': {'read_only': read_only},
             'is_template_editor': {'read_only': read_only},
             'is_guest': {'read_only': read_only},
             'is_global_archiver': {'read_only': read_only},

Source: Syslifters/sysreptor commit de8b5d8 — The patch adds the missing is_project_admin field to the read-only enforcement dictionary, ensuring only administrators can modify this flag.

Detection Methods for CVE-2025-59945

Indicators of Compromise

User accounts whose is_project_admin attribute changed without an administrator action in the audit log.
API requests to user update endpoints containing is_project_admin in the JSON body originating from non-admin sessions.
Access to pentest project resources by users who are not listed as project members.
Sudden spikes in project read or export activity from previously low-privileged accounts.

Detection Strategies

Audit the SysReptor user database and list every account with is_project_admin=true, comparing against known administrator-issued grants.
Review application logs and reverse proxy access logs for PATCH or PUT requests targeting /api/v1/pentestusers/self/ or /api/v1/users/<id>/ containing the is_project_admin field.
Correlate project access events with user permission change timestamps to identify unauthorized elevation followed by data access.

Monitoring Recommendations

Forward SysReptor application logs to a centralized logging platform and alert on permission flag mutations.
Monitor for project read, export, or deletion actions performed by users outside the project membership list.
Track baseline user privilege state and trigger alerts on any deviation in permission attributes.

How to Mitigate CVE-2025-59945

Immediate Actions Required

Upgrade all SysReptor deployments to version 2025.83 or later without delay.
Inventory all users with is_project_admin=true and revoke the flag from any account that should not hold it.
Rotate API tokens and session credentials for any account suspected of unauthorized privilege elevation.
Review project access logs for the period since 2024.74 was deployed to identify possible data exposure.

Patch Information

Syslifters released the fix in SysReptor version 2025.83. The patch updates api/src/sysreptor/users/serializers.py to enforce the read_only flag on is_project_admin for non-administrative users. Refer to the GitHub Security Advisory GHSA-r6hm-59cq-gjg6 and the upstream commit de8b5d8 for full remediation details.

Workarounds

Restrict network access to the SysReptor API to trusted operators using firewall rules or a VPN until the upgrade is applied.
Temporarily disable or remove non-administrative user accounts that do not require active access during the patch window.
Place a reverse proxy rule in front of SysReptor that rejects API requests containing is_project_admin in the request body from non-admin sessions.

bash

# Upgrade SysReptor using the official Docker deployment script
cd sysreptor/deploy
curl -s https://docs.sysreptor.com/install.sh | bash

# Verify the running version is 2025.83 or later
docker compose exec app python3 manage.py --version

# Audit users with elevated project admin privileges
docker compose exec app python3 manage.py shell -c \
  "from sysreptor.users.models import PentestUser; \
   print([u.username for u in PentestUser.objects.filter(is_project_admin=True)])"