CVE-2026-44987 Overview
CVE-2026-44987 is a privilege escalation vulnerability in SysReptor, a customizable pentest reporting platform. The flaw allows users holding User Admin permissions to change the email addresses of accounts with Superuser permissions. When the optional Forgot Password functionality is enabled, a user manager can trigger a password reset against the modified email and authenticate as the Superuser, provided multi-factor authentication is not configured. Successful exploitation grants access to the Django /admin backend and full control over SysReptor settings. The issue is tracked under [CWE-269: Improper Privilege Management] and is fixed in version 2026.29.
Critical Impact
A user manager can take over Superuser accounts on installations with Forgot Password enabled and MFA disabled, gaining administrative control over the SysReptor deployment.
Affected Products
- SysReptor versions prior to 2026.29
- SysReptor installations with the non-default Forgot Password feature enabled
- Superuser accounts without MFA configured
Discovery Timeline
- 2026-05-08 - CVE-2026-44987 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44987
Vulnerability Analysis
The vulnerability stems from missing role-based restrictions on the user update endpoint in SysReptor. The application permits accounts with the User Admin role to edit attributes, including the email field, of accounts assigned the Superuser role. SysReptor's permission model intentionally grants user managers broad project access, but it should not extend to modifying privileged account identity attributes.
When the Forgot Password workflow is enabled, the password reset link is sent to whatever email address is recorded for the target user. By rewriting the Superuser's email to one they control, an attacker with User Admin rights converts a lower privileged role into full Superuser access. The bypass succeeds only when the target Superuser has no MFA enrolled, since MFA gates the post-reset authentication step.
Once authenticated as a Superuser, the attacker can reach the Django /admin interface and reconfigure the SysReptor instance, including authentication settings, integrations, and stored project data.
Root Cause
The root cause is improper privilege management [CWE-269]. The user management API did not enforce a check that prevents lower privileged roles from modifying identity fields of higher privileged accounts.
Attack Vector
Exploitation is performed over the network by an authenticated user holding the User Admin role. The attacker updates the Superuser's email, requests a password reset, captures the reset token from the inbox under their control, and sets a new password. The technique fails against Superusers protected by MFA. See the GitHub Security Advisory GHSA-6x8f-v3cf-cvr3 for vendor details.
Detection Methods for CVE-2026-44987
Indicators of Compromise
- Audit log entries showing email address changes on accounts with Superuser permissions performed by non-Superuser actors
- Password reset requests for Superuser accounts shortly after an email modification event
- New or unexpected logins to the Django /admin interface from user accounts that previously held only User Admin rights
Detection Strategies
- Review SysReptor application logs for PATCH or PUT requests against user objects where the target user holds Superuser and the actor does not
- Correlate user profile modification events with subsequent forgot-password and login events within short time windows
- Alert on access to the /admin Django path by accounts that have not historically used it
Monitoring Recommendations
- Forward SysReptor and reverse proxy access logs to a centralized log platform for correlation and retention
- Monitor outbound mail logs for password reset emails sent to addresses outside the organization's domain
- Track changes to Superuser account attributes and trigger alerts on any modification
How to Mitigate CVE-2026-44987
Immediate Actions Required
- Upgrade SysReptor to version 2026.29 or later, available from the GitHub Release 2026.29 page
- Enforce multi-factor authentication on every account holding Superuser permissions
- Review the list of accounts with User Admin permissions and remove unneeded assignments
- Audit recent user modification and password reset events for signs of prior abuse
Patch Information
The SysReptor maintainers fixed CVE-2026-44987 in version 2026.29. The patch prevents User Admin accounts from modifying email addresses of Superuser accounts. Refer to the GitHub Security Advisory GHSA-6x8f-v3cf-cvr3 for the full advisory.
Workarounds
- Disable the Forgot Password functionality until the upgrade to 2026.29 is completed, since it is not enabled by default
- Require MFA enrollment on all Superuser accounts to block the password reset authentication path
- Restrict the User Admin role to a minimal set of trusted operators
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
