CVE-2026-42291: SysReptor Auth Bypass Vulnerability

CVE-2026-42291 Overview

CVE-2026-42291 is a broken access control vulnerability in SysReptor, a customizable pentest reporting platform. The flaw exists in the endpoints that read and create sharing links for personal notes. Affected versions range from 2026.4 to versions prior to 2026.27. Authenticated attackers who obtain a victim's note ID can list and create sharing links to that user's personal notes. This grants read and write access to notes belonging to other users. The issue impacts SysReptor Professional. In SysReptor Community, all users hold superuser permissions by default, so the flaw has no additional impact there. The maintainers patched the vulnerability in version 2026.27.

Critical Impact
Authenticated SysReptor Professional users who guess or obtain another user's note ID can read and modify that user's personal notes through the sharing-link endpoints.

Affected Products

SysReptor Professional versions 2026.4 through versions prior to 2026.27
SysReptor Community versions 2026.4 through versions prior to 2026.27 (no additional impact due to default superuser permissions)
Personal notes sharing-link endpoints

Discovery Timeline

2026-05-08 - CVE-2026-42291 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42291

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) classified under [CWE-639] Authorization Bypass Through User-Controlled Key. SysReptor exposes endpoints to list and create sharing links for personal notes. These endpoints validate that the requester is authenticated but fail to verify that the requester owns the note referenced by the supplied note ID. An authenticated user who supplies another user's note ID receives access to operations that should be restricted to the note owner.

The attacker gains both read and write access to the victim's personal notes through generated sharing links. Personal notes in a pentest reporting platform commonly contain sensitive engagement data, credentials harvested during testing, and client information. The CVSS attack complexity is rated High because the attacker must first obtain or guess the victim's note ID, which is not exposed in the standard user interface to non-owners.

Root Cause

The sharing-link endpoints for personal notes enforce authentication but omit object-level authorization. The application does not check that the authenticated principal is the owner of the note identified by the request parameter. This is a missing function-level access control check on the note resource.

Attack Vector

An authenticated SysReptor Professional user sends requests to the personal-note sharing-link endpoints, supplying a note ID belonging to another user. The server returns existing sharing links and allows creation of new sharing links for the target note. The attacker then uses the returned sharing link to read or write the victim's note contents. The exploit works over the network with low privileges and no user interaction. No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-pcpr-q2qj-3v43 for vendor-supplied technical detail.

Detection Methods for CVE-2026-42291

Indicators of Compromise

Unexpected sharing links appearing on personal notes that the owner did not create
Sharing-link creation requests originating from user accounts that do not own the referenced note ID
Access logs showing repeated requests to the personal-notes sharing-link endpoints with varied note ID parameters, indicating ID enumeration

Detection Strategies

Audit SysReptor application logs for sharing-link list and create requests, correlating the authenticated user ID against the owner of the referenced note ID
Alert on a single user account creating sharing links across multiple distinct note owners within a short time window
Review database tables that store sharing links for records where the creator account differs from the note owner account

Monitoring Recommendations

Enable verbose request logging on the SysReptor API, capturing endpoint paths, authenticated user, and target object identifiers
Forward SysReptor logs to a centralized log platform and build queries for anomalous access patterns to the personal notes endpoints
Track creation rate of new note sharing links per user and alert on deviations from the established baseline

How to Mitigate CVE-2026-42291

Immediate Actions Required

Upgrade SysReptor to version 2026.27 or later, which contains the authorization fix
Audit existing sharing links for personal notes and revoke any that were not created by the legitimate note owner
Rotate any credentials or secrets that may have been stored in personal notes during the exposure window

Patch Information

The SysReptor maintainers released the fix in version 2026.27. Upgrade instructions and release notes are available in the GitHub SysReptor 2026.27 Release. The advisory tracking this issue is published as GitHub Security Advisory GHSA-pcpr-q2qj-3v43.

Workarounds

No vendor-supplied workaround is documented; upgrading to 2026.27 is the supported remediation
Restrict network access to the SysReptor instance to trusted operators until the upgrade is applied
Review user accounts on the platform and remove accounts that are no longer required to reduce the authenticated attacker surface

bash

# Upgrade SysReptor to the patched release (Docker deployment)
cd sysreptor/deploy
git pull
./update.sh
# Verify the running version is 2026.27 or later
docker compose exec app python3 manage.py version