CVE-2026-77767: Reconmap API Information Disclosure Flaw

CVE-2026-77767 Overview

CVE-2026-77767 is a missing authorization vulnerability [CWE-862] in Reconmap, an open-source penetration testing collaboration platform. The PreviewReport action in apps/api/app/Controllers/ReportsController.cs carries an [AllowAnonymous] attribute that bypasses the API's fallback authorization policy. An unauthenticated remote caller can enumerate sequential project IDs to retrieve engagement details and client organisation records from every project on the instance. Because Reconmap stores penetration-testing engagements, the exposed project descriptions, client names, addresses, and URLs are inherently sensitive.

Critical Impact

Unauthenticated remote attackers can enumerate every penetration-testing project and client organisation stored in a Reconmap instance without any credentials.

Affected Products

• Reconmap API (apps/api)
• Reconmap versions prior to commit 2b2eb0c
• Deployments exposing the /reports/{id}/preview endpoint

Discovery Timeline

• 2026-08-21 - CVE-2026-77767 published to NVD
• 2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-77767

Vulnerability Analysis

Reconmap's API defines a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role. Controllers without their own authorization attribute reject anonymous callers by default. The report preview action in ReportsController.cs opts out of that policy by declaring [AllowAnonymous], removing all authentication, project membership, and role checks.

When invoked, PreviewReport loads the Project row identified by the id path segment, resolves the linked Organisation through the project's ClientId, and renders both objects into default-report-template.html. The rendered output includes the project name and description alongside the client organisation's name, address, and URL. The endpoint returns this data directly to the anonymous caller.

Root Cause

The root cause is an explicit [AllowAnonymous] attribute on an action that reads sensitive tenant data [CWE-862]. Because the id parameter maps to the auto-increment primary key of the project table, attackers can walk sequential integers to enumerate all projects. The 404 response for missing IDs also reveals which project IDs exist, enabling reliable enumeration.

Attack Vector

An unauthenticated attacker sends GET requests to /{id}/preview starting at id=1 and incrementing until responses stop returning content. Each successful response embeds project engagement details and the associated client organisation in HTML. No credentials, session, or role assignment is required.

// Vulnerable endpoint (removed by upstream patch)
[HttpGet("{id:int}/preview")]
[AllowAnonymous]
[ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status404NotFound)]
public async Task<IActionResult> PreviewReport(uint id)
{
    var existing = await dbContext.Projects.FindAsync(id);
    if (existing == null) return NotFound();

    var client = await dbContext.Organisations.FindAsync(existing.ClientId);

    string data;
    await using (var templateStream = await attachmentStorage.GetFileStreamAsync("default-report-template.html"))
    {
        using (var reader = new StreamReader(templateStream))
        {
            data = await reader.ReadToEndAsync();
        }
    }

    var tpl = Template.Parse(data);
    var res = await tpl.RenderAsync(new { project = existing, client });
    // ...
}

Source: GitHub Commit 2b2eb0c

Detection Methods for CVE-2026-77767

Indicators of Compromise

• Sequential GET requests to /{id}/preview from a single source IP walking numeric IDs.
• HTTP 200 responses with Content-Type: text/html; charset=utf-8 served without an authenticated session cookie or bearer token.
• Elevated ratio of 404 responses on the preview endpoint, indicating ID probing.

Detection Strategies

• Inspect web server and reverse proxy logs for anonymous requests to the /preview path on the Reconmap API.
• Alert on high-volume access patterns that increment integer path segments on report endpoints.
• Correlate access to PreviewReport with the absence of Authorization headers or authenticated session identifiers.

Monitoring Recommendations

• Forward Reconmap API access logs to a centralized logging platform for retention and analysis.
• Baseline normal report preview usage and alert on deviations that suggest enumeration.
• Monitor outbound egress from the Reconmap host for large HTML response bodies delivered to unauthenticated clients.

How to Mitigate CVE-2026-77767

Immediate Actions Required

• Update Reconmap to a build that includes commit 2b2eb0c, which removes the vulnerable preview action.
• Restrict network access to the Reconmap API so it is not reachable from untrusted networks until patched.
• Review access logs for prior anonymous requests to /preview and treat any successful responses as data disclosure events.

Patch Information

The upstream fix removes the PreviewReport action and the associated HTML/TXT report format handling in ReportGenerationProcessor.cs. See the GitHub Security Advisory GHSA-mhrh-jfmr-8mmw and the VulnCheck Advisory on Reconmap for advisory details.

Workarounds

• Block the /{id}/preview route at a reverse proxy or web application firewall until the patch is applied.
• Require authentication at the proxy layer for all Reconmap API paths, overriding the application-level [AllowAnonymous] attribute.
• Notify affected clients if log review indicates their organisation records were accessed anonymously.

# Example NGINX rule to block anonymous access to the vulnerable endpoint
location ~ ^/[0-9]+/preview$ {
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://reconmap_api;
}