Syslifters sysreptor before version 2026.29 contains a privilege management flaw where users with "User Admin" rights can alter the email addresses of "Superuser" accounts. If the optional "Forgot Password" feature is enabled and the targeted Superuser lacks multi-factor authentication, the attacker can reset the Superuser's password and authenticate as that user. This leads to unauthorized access to the Django admin backend and configuration settings. The ability for user managers to assign themselves "Project Admin" permissions and access pentest projects is by design and not part of the vulnerability. The issue is resolved in version 2026.29.

An attacker with "User Admin" permissions can escalate privileges to Superuser level by resetting passwords if the "Forgot Password" feature is enabled and MFA is not used by the Superuser. This enables unauthorized access to the Django backend and full control over the Sysreptor installation settings. The impact is limited by the prerequisite permissions and optional feature settings. The CVSS score of 3.8 reflects a low severity impact with limited confidentiality and integrity loss and no availability impact.

Upgrade Sysreptor to version 2026.29 or later where this vulnerability is patched. If upgrading immediately is not possible, ensure the "Forgot Password" functionality is disabled (default setting) and enforce multi-factor authentication for all Superuser accounts to prevent exploitation.