Executive brief
SysReptor is a platform used by security professionals to create and manage penetration testing reports. A security flaw in the Professional version allows logged-in users to access or modify the private notes of other users if they can guess or obtain a specific note identifier. This could lead to the exposure of sensitive security findings or unauthorized changes to project documentation.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in SysReptor's personal notes functionality due to improper authorization checks on specific API endpoints. Authenticated attackers who obtain a victim's note ID can list and create sharing links for those notes, granting them unauthorized read and write access. While the vulnerability exists in both Community and Professional editions, it primarily impacts the Professional edition's multi-user security model; in the Community edition, all users are superusers by default. The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and has been patched in version 2026.27.
Affected products
- Syslifters SysReptor 2026.4 to 2026.26
Timeline
- 2026-04-21: disclosed: Vulnerability reported by Robin Lunde (@pwnpanda)
- 2026-04-22: patched: Fixed in version 2026.27
- 2026-05-08: advisory: CVE-2026-42291 published