PT-2025-39701 · Sysreptor · Sysreptor

Published 2025-09-27 · Updated 2025-12-11 · CVE-2025-59945

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SysReptor versions 2024.74 through 2025.82

Description Authenticated, unprivileged users can assign the is project admin permission to themselves, granting them unauthorized access to read, modify, and delete pentesting projects they are not members of. This allows access to projects that users should not be able to access.

Recommendations Update to version 2025.83 or later.

Exploit

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-59945

GHSA-R6HM-59CQ-GJG6

Affected Products

Sysreptor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59945.json · Exploit
• https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4 · Patch
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59945 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59945 · Vendor Advisory
• https://t.me/cveNotify/136674 · Telegram Post
• https://twitter.com/cracbot/status/1973704556648304738 · Twitter Post
• https://t.me/cveNotify/145503 · Telegram Post
• https://t.me/CVEtracker/33515 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971770698134700529 · Twitter Post
• https://twitter.com/SysReptor/status/1972631643207672199 · Twitter Post