PT-2026-39204 · Sysreptor · Sysreptor

Pwnpanda + 1 · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42291

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SysReptor versions 2026.4 through 2026.26

Description Improper authorization in endpoints used for reading and creating sharing links for personal notes allows authenticated attackers with a victim's note ID to list and create sharing links to those notes. This results in unauthorized read and write access to other users' personal notes. This issue affects both Professional and Community editions, although it has no practical impact on the Community edition since all users possess superuser permissions and can already list personal notes via the '/admin/pentests/usernotebookpage/' endpoint.

Recommendations Update to version 2026.27.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-42291

Affected Products

Sysreptor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42291 · Security Note
• https://github.com/Syslifters/sysreptor/releases/tag/2026.27 · Note
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43 · Note
• https://twitter.com/VulmonFeeds/status/2052944997750599955 · Twitter Post
• https://twitter.com/CVEnew/status/2053131429182427618 · Twitter Post
• https://t.me/CVEtracker/53163 · Telegram Post