PT-2026-39211 · Sysreptor · Sysreptor

Lowaronmolnar · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-44987

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.29

Description Users with "User Admin" permissions can modify the email addresses of users with "Superuser" permissions. When the "Forgot Password" functionality is enabled, these users can reset Superuser passwords and authenticate, provided the Superuser does not have multi-factor authentication (MFA) enabled. This allows unauthorized access to the Django backend endpoint "/admin" or the ability to manipulate installation settings.

Recommendations Update to version 2026.29.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-44987

Affected Products

Sysreptor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44987 · Security Note
• https://github.com/Syslifters/sysreptor/releases/tag/2026.29 · Note
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3 · Note
• https://t.me/CVEtracker/53185 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052914281260179882 · Twitter Post
• https://twitter.com/CVEnew/status/2053131428259664099 · Twitter Post