CVE-2026-81178: CWE-863: Incorrect Authorization in Syslifters sysreptor
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
AI Analysis
Technical Summary
SysReptor, a pentest reporting platform, had an authorization flaw where unauthenticated users accessing a public note share link were inadvertently included in the same collaboration group as authenticated project members. This caused the system to forward client information, connection, awareness, and deletion events beyond the intended shared note subtree. As a result, sensitive metadata such as project member identities and live editing activity of non-shared notes were exposed. The vulnerability does not allow unauthorized content modification. The flaw was resolved in version 2026.55.
Potential Impact
The vulnerability allows unauthorized disclosure of project-wide collaborative metadata, including usernames and live editing activity of notes not intended for public sharing. This could lead to privacy concerns and exposure of project member identities. However, the actual content of non-shared notes remains confidential, and no unauthorized write or modification capabilities are granted.
Mitigation Recommendations
Upgrade to SysReptor version 2026.55 or later, where this authorization issue has been fixed. No other mitigation is required as the vendor has provided an official fix.
CVE-2026-81178: CWE-863: Incorrect Authorization in Syslifters sysreptor
Description
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
CVSS v3.1
Score 3.5low
Affected software
Syslifters
sysreptor
pkg:github/syslifters/sysreptorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SysReptor, a pentest reporting platform, had an authorization flaw where unauthenticated users accessing a public note share link were inadvertently included in the same collaboration group as authenticated project members. This caused the system to forward client information, connection, awareness, and deletion events beyond the intended shared note subtree. As a result, sensitive metadata such as project member identities and live editing activity of non-shared notes were exposed. The vulnerability does not allow unauthorized content modification. The flaw was resolved in version 2026.55.
Potential Impact
The vulnerability allows unauthorized disclosure of project-wide collaborative metadata, including usernames and live editing activity of notes not intended for public sharing. This could lead to privacy concerns and exposure of project member identities. However, the actual content of non-shared notes remains confidential, and no unauthorized write or modification capabilities are granted.
Mitigation Recommendations
Upgrade to SysReptor version 2026.55 or later, where this authorization issue has been fixed. No other mitigation is required as the vendor has provided an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-26T16:26:08.967Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad792755bf5e2cf5562f9a
Added to database: 09/18/2026, 17:47:19 UTC
Last enriched: 09/18/2026, 18:01:42 UTC
Last updated: 09/18/2026, 18:41:48 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.