CVE-2026-81181 describes a session fixation vulnerability (CWE-384) in SysReptor, a pentest reporting platform. Specifically, before version 2026.68, the password authentication flow for protected shared notes fails to rotate the session ID upon successful authentication. An attacker who can obtain an unauthenticated session cookie and cause a victim to use it on the shared-note URL can reuse the session after the victim authenticates, gaining unauthorized access to that shared note. The main SysReptor login flow is unaffected by this issue. The vulnerability is resolved in version 2026.68.

The vulnerability allows an attacker with the ability to set a victim's session cookie and knowledge of the shared-note URL to access protected shared notes after the victim authenticates. This results in limited confidentiality and integrity impact on shared notes. The main login flow and other parts of the application are not affected. The CVSS score is 3.7 (low severity), reflecting the limited scope and complexity of exploitation.

Upgrade SysReptor to version 2026.68 or later, where the session fixation vulnerability is fixed by rotating the session identifier after successful authentication in the shared notes password flow. No other mitigation is required as the vendor has provided an official fix.