CVE-2026-81181: SysReptor Session Fixation Vulnerability

CVE-2026-81181 Overview

CVE-2026-81181 is a session fixation vulnerability in SysReptor, a customizable pentest reporting platform developed by Syslifters. The flaw exists in the password authentication flow for protected shared notes prior to version 2026.68. The application fails to rotate the session identifier after a successful authentication, allowing an attacker to reuse a pre-planted session cookie. The main SysReptor login flow is not affected by this issue. The vulnerability is tracked under CWE-384: Session Fixation and was resolved in SysReptor release 2026.68.

Critical Impact
An attacker who plants an unauthenticated session cookie in a victim's browser and knows the shared-note URL can access the shared note after the victim authenticates successfully.

Affected Products

SysReptor versions prior to 2026.68
Self-hosted SysReptor deployments exposing protected shared notes
SysReptor instances used for collaborative pentest reporting

Discovery Timeline

2026-09-18 - CVE-2026-81181 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-81181

Vulnerability Analysis

SysReptor supports shared notes protected by a password, allowing authenticated collaborators to grant restricted read access to external parties. The authentication flow verifies the submitted password but reuses the existing session identifier after success. This behavior violates a core session management principle: any privilege change should trigger a session rotation. Because the identifier remains constant across the authentication boundary, a session issued to an unauthenticated visitor becomes a valid authenticated session once the victim submits the correct password.

The attacker never learns the shared-note password. Instead, the attack pivots on the trust the server places in a session cookie whose provenance it cannot verify. This is a classic session fixation pattern applied to a narrow shared-resource flow rather than to primary login.

Root Cause

The root cause is missing session identifier regeneration after a successful password check in the shared notes authentication handler. The server upgrades the session's authorization state in place instead of issuing a new session token, leaving any previously distributed cookie value valid.

Attack Vector

Exploitation requires several conditions to align. The attacker must obtain an unauthenticated SysReptor session cookie, deliver it to the victim's browser, and know the specific shared-note URL the victim will visit. Cookie delivery typically requires an adjacent web vulnerability, network position, or a permissive cookie scope. The victim must then authenticate to the shared note using the correct password. After authentication, the attacker replays the fixed session cookie against the same shared-note endpoint to read its contents. User interaction is required and attack complexity is high, which limits practical exploitation.

The vulnerability is described in prose only. Refer to the GitHub Security Advisory GHSA-wgx3-84xg-q93j and the remediation commit for implementation-level detail.

Detection Methods for CVE-2026-81181

Indicators of Compromise

Repeated requests to the same shared-note URL from two distinct client IP addresses or user agents sharing an identical session cookie value.
Access to a shared note from a source IP or geolocation that does not correspond to any known collaborator on the associated project.
Session cookies present in requests to shared-note endpoints that were first observed before the victim's successful password submission.

Detection Strategies

Correlate SysReptor application logs with reverse-proxy access logs to identify session identifiers that persist across an authentication event on protected shared notes.
Flag any shared-note session cookie that is observed originating from more than one client fingerprint within a short time window.
Alert on shared-note read activity that occurs seconds after a successful password authentication from a different network path.

Monitoring Recommendations

Enable verbose access logging on the SysReptor reverse proxy and retain logs long enough to reconstruct shared-note sessions.
Forward SysReptor and proxy logs to a centralized analytics platform for cross-source correlation and long-term retention.
Review shared-note access patterns during any incident involving suspected cookie theft or cross-site scripting against user browsers.

How to Mitigate CVE-2026-81181

Immediate Actions Required

Upgrade SysReptor to version 2026.68 or later, which regenerates the session identifier after shared-note authentication.
Invalidate all active SysReptor sessions after upgrading so any previously fixed cookies are rendered unusable.
Rotate passwords on existing protected shared notes if unauthorized access cannot be ruled out from log review.

Patch Information

The vendor released the fix in SysReptor 2026.68. The corrective change is documented in the upstream commit 1981717 and the GitHub Security Advisory GHSA-wgx3-84xg-q93j. Administrators running containerized deployments should pull the updated image and redeploy.

Workarounds

Restrict shared-note distribution to trusted channels and avoid embedding shared-note URLs in messages that traverse untrusted infrastructure.
Enforce the Secure, HttpOnly, and SameSite=Strict attributes on SysReptor session cookies at the reverse proxy to limit cross-origin cookie injection.
Terminate protected shared notes and reissue them with new URLs once the platform is upgraded.

bash

# Configuration example: upgrade SysReptor to the patched release
cd /opt/sysreptor/deploy
git fetch --tags
git checkout 2026.68
docker compose pull
docker compose up -d