CVE-2026-81178 Overview
SysReptor is a customizable penetration test reporting platform used by security teams to author and collaborate on engagement reports. CVE-2026-81178 is a broken authorization issue [CWE-863] in SysReptor versions prior to 2026.55. When an unauthenticated user opens a public note share link, the share consumer joins the same collaboration group as authenticated project members. The server then forwards client information, connection, awareness, and deletion events across the entire project rather than restricting them to the shared note subtree. The flaw exposes project-wide collaborative editing metadata but does not expose the content of non-shared notes and does not grant write access.
Critical Impact
Unauthenticated holders of a public note share link can enumerate project member usernames, note identifiers, and live editing activity for notes that were never shared with them.
Affected Products
- SysReptor pentest reporting platform, all versions prior to 2026.55
- Self-hosted SysReptor deployments exposing public note share links
- SysReptor Cloud tenants running vulnerable builds prior to remediation
Discovery Timeline
- 2026-09-18 - CVE-2026-81178 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
- Version 2026.55 - Syslifters released the fix in SysReptor 2026.55
Technical Details for CVE-2026-81178
Vulnerability Analysis
SysReptor uses a real-time collaboration channel so multiple project members can edit notes concurrently. Each connected client joins a collaboration group scoped to a project and receives events describing peers, cursor positions, connection state, and note deletions. Public note share links let external reviewers read a single note without authenticating. The share consumer, however, was placed into the same project-wide collaboration group as authenticated users. Events intended for internal members were relayed to the anonymous viewer without a per-event authorization check against the shared note subtree.
The exposed metadata reveals usernames and display names of project members, identifiers of sibling notes, and live indicators of editing activity across the project. An attacker with a share link can map project membership, infer active engagements, and correlate note identifiers for follow-on reconnaissance. Note contents outside the shared subtree remain protected, and the collaboration channel does not accept writes from the unauthenticated consumer.
Root Cause
The root cause is a missing authorization check when routing collaboration events to a public share consumer. The server relied on group membership rather than validating that each awareness, connection, or deletion event referenced the shared note subtree. The commit 1e52e5058b0c7f420dc45c87ad72e7a4585477b1 restricts these events so the public consumer only receives messages tied to the shared node.
Attack Vector
Exploitation requires an existing public share link and user interaction to open it. The attacker connects to the collaboration channel through the standard share URL and passively observes the metadata stream. No credentials, elevated privileges, or client-side exploits are required beyond loading the share endpoint.
The vulnerability manifests in the collaboration event dispatcher. See the GitHub Security Advisory GHSA-926c and the GitHub Sysreptor Commit for the specific code paths and remediation.
Detection Methods for CVE-2026-81178
Indicators of Compromise
- Long-lived WebSocket connections to SysReptor collaboration endpoints originating from unauthenticated share-link sessions.
- Public share URLs appearing in referrer logs paired with sustained collaboration channel traffic.
- Access to share endpoints from IP addresses or user agents that do not correspond to known project members or reviewers.
Detection Strategies
- Review SysReptor application logs for public share sessions that remain connected to the collaboration channel far longer than needed to read a single note.
- Correlate share-link issuance events with subsequent connection counts to identify links accessed by unexpected volumes of anonymous clients.
- Audit exported or shared note links against project scopes to identify any leaked links that could have been used before upgrading.
Monitoring Recommendations
- Alert on anonymous connections to the collaboration WebSocket that persist beyond typical read sessions.
- Track the distribution and revocation lifecycle of public share links to identify stale or overly broad shares.
- Forward SysReptor access logs to a centralized logging or SIEM platform for retention and correlation across engagements.
How to Mitigate CVE-2026-81178
Immediate Actions Required
- Upgrade SysReptor to version 2026.55 or later, which restricts collaboration events for public share consumers to the shared note subtree.
- Revoke existing public note share links after upgrade and reissue only those still required for active reviews.
- Inventory projects that used public shares while running vulnerable versions and treat member identities and note identifiers as potentially disclosed.
Patch Information
The fix is included in the GitHub Sysreptor Release 2026.55 and the corresponding source change in the GitHub Sysreptor Commit. Administrators of self-hosted deployments should pull the updated container images or source tag and redeploy. SysReptor Cloud tenants receive the fix through the vendor upgrade process.
Workarounds
- Disable public note sharing until the upgrade to 2026.55 is complete.
- Restrict access to the SysReptor instance behind a VPN or IP allow list to limit exposure of share endpoints to trusted reviewers.
- Minimize the number of notes and project members active during any period when a public share link is issued to reduce the metadata available to a share consumer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
