Syslifters sysreptor versions before 2026.58 have a vulnerability (CWE-807) where reliance on untrusted Host headers in password reset links allows an unauthenticated attacker to generate reset emails with links pointing to attacker-controlled hosts. If ALLOWED_HOSTS is configured with a wildcard and password reset by email is enabled, the attacker can cause victims to disclose reset tokens by clicking these malicious links, enabling account takeover. The vulnerability requires a configured email gateway and a victim's email address, and some reverse proxy setups may block hostile Host headers. The vulnerability is addressed in sysreptor version 2026.58.

An unauthenticated attacker can reset a victim's password and take over their account by exploiting the acceptance of attacker-controlled Host headers in password reset links. This leads to disclosure of reset tokens and complete account compromise. The impact is high confidentiality and integrity loss for affected accounts. Availability is not affected. Exploitation depends on email gateway configuration and victim email address availability.

Upgrade sysreptor to version 2026.58 or later, where this vulnerability is fixed. Ensure ALLOWED_HOSTS is not configured with a wildcard when enabling password reset by email. Review reverse proxy configurations to reject hostile Host headers. No other vendor advisories indicate additional mitigations or that no action is required.