Threats affecting pkg:github/reconmap

CVE-2026-77767 is a missing authorization vulnerability in Reconmap's API allowing unauthenticated remote attackers to access sensitive project and client organization information. The vulnerability arises because the report preview action is marked with [AllowAnonymous], bypassing the default admin-only authorization policy. Attackers can enumerate project IDs to retrieve penetration-testing engagement details and client records without authentication or role checks.