Executive brief
Reconmap is a security testing platform used to manage penetration testing engagements and client relationships. An unauthenticated attacker can access the report preview API endpoint to retrieve sensitive engagement details and client organization information for any project by guessing sequential project IDs, exposing confidential penetration testing scope and client records.
Technical details
The vulnerability is an authorization bypass in the ReportsController.PreviewReport action. Although Reconmap applies a default require-authenticated-administrator policy at the application level in Program.cs, the PreviewReport method is decorated with [AllowAnonymous] and opts out of this policy. The endpoint accepts a project id path segment, loads the project and linked organization, and renders both into a report template without performing any authentication, membership, or role checks. Because project IDs are sequential auto-increment primary keys, an unauthenticated remote attacker can enumerate all projects by iterating through ID values. The endpoint returns a 404 for non-existent IDs, which also leaks information about which IDs are valid, enabling complete project enumeration.
Affected products
- Reconmap Reconmap <UNKNOWN>
Timeline
- 2026-08-21: disclosed