Syslifters sysreptor, a pentest reporting platform, contains an authorization bypass vulnerability (CWE-639) in versions from 2026.4 to before 2026.27. The flaw exists in the endpoints handling sharing links for personal notes, where insufficient authorization checks allow authenticated users who obtain note IDs of other users to list and create sharing links for those notes. This effectively grants read and write access to other users' personal notes. The vulnerability affects both Professional and Community editions; however, the Community edition's default superuser permissions reduce the impact. The issue was fixed in version 2026.27.

An authenticated attacker can bypass authorization controls to read and modify personal notes of other users by exploiting the sharing link endpoints. This compromises confidentiality and integrity of user notes. There is no indication of availability impact. The vulnerability is rated medium severity with a CVSS score of 6.8.

This vulnerability has been patched in sysreptor version 2026.27. Users should upgrade to version 2026.27 or later to remediate the issue. No additional vendor advisory or temporary mitigations are provided. Patch status is confirmed by the vendor's versioning information.